cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

1168
Views
0
Helpful
10
Replies
shotalezhava
Beginner

Inter-VLAN Routing configuration in Firepower 1010

hello i have 3 V LAN, hosts can ping their default gateway  can connect to FM C but can not ping each other, on A C P i Allow everything, ft d can ping all hosts. what can be  a problem?

1 ACCEPTED SOLUTION

Accepted Solutions
Rob Ingram
VIP Mentor

The result of that packet-tracer output was an "allow", which means the traffic should be permitted by the FTD.

I suggest you disable the local firewall on the hosts for testing and try again.

View solution in original post

10 REPLIES 10
Rob Ingram
VIP Mentor

Hi @shotalezhava 

Do you have sub-interfaces on the FTD?

Is the FTD the default gateway for each VLAN?

Do you have NAT exemption rules in place to ensure the inter-vlan traffic is not unintentially natted?

Please can you run packet-tracer from the CLI and provide the output for review. Example: packet-tracer input <interface> <protocol> <src ip> <src port> <dst ip> <dst port>

Provide some output of your FTD and switch configuration.

sorry i do not know how to run paket-tracer from CLI, i have sub-interface, host can ping ftd and all vlan can connect to fmc. default gateway is correct on host it is ftd sub-interface ip.

Rob Ingram
VIP Mentor

@shotalezhava Run the following from the CLI of the FTD and provide the output:-

 

packet-tracer input managment icmp 192.168.77.11 8 0 192.168.10.10

 

Can the FTD ping a host in each of the vlans?

Does the host you are trying to ping (192.168.10.10) have a local firewall turned on that could be preventing a ping response?

local firewall allow icmp Ipv4

packet-tracer input managment icmp 192.168.77.11 8 0 192.168.10.10

 

Rob Ingram
VIP Mentor

The result of that packet-tracer output was an "allow", which means the traffic should be permitted by the FTD.

I suggest you disable the local firewall on the hosts for testing and try again.

View solution in original post

icmp is allow i tried share folder but it is same

Rob Ingram
VIP Mentor

Right fine, but you are troubleshooting a problem with the FTD....you can easily eliminate that a potential issue by temporarily disabling the local firewall on the windows host and then test.

 

Aside from that, is the FTD the default gateway definately of the windows host?

 

Run the command "system support firewall-engine-debug" from the FTD CLI and filter on the ip address(es) you are testing with and then run some tests to generate some traffic.

 

You could also run packet capture on the windows host.

it was windows firewall problem!  thanks

shotalezhava
Beginner

hello i create HA and i have error Frequent drain of Archives & Cores & File Logs

Content for Community-Ad