topic Re: Disabled Mgmt interface of firewall responds to ping in General Topics

Disabled Mgmt interface of firewall responds to ping

kadar2 — Thu, 21 May 2020 08:39:59 GMT

Hi all,

we are running R80.30 and we noticed that when we ping the mgmt. interface of the firewall, even though it is not enabled, it responds to ping.

We performed fw monitor -e "host(mgmt_ip),accept;" and run a continuous ping. The request passes the IN interface (iI) and then exits again through the same interface (oO) as expected.

We would have thought that because the mgmt. interface is not enabled, we shouldn't get a response.

Can someone explain this behavior?

Thank you in advance,

Katerina

Re: Disabled Mgmt interface of firewall responds to ping

funkylicious — Thu, 21 May 2020 09:44:24 GMT

Hi,

If you run a ping directly from the firewall to the mgmt intf when it's in off state, it's normal to respond to ping because locally it doesn't care about the state of the interface, unlike other vendors. From an external device the ping won't/shouldn't work.

Re: Disabled Mgmt interface of firewall responds to ping

Chris_Atkinson — Thu, 21 May 2020 12:46:30 GMT

How was the interface disabled and what was the source of the ping?

When you say the Mgmt interface note the 'role' can be assigned to another port on the appliance...

Re: Disabled Mgmt interface of firewall responds to ping

kadar2 — Fri, 22 May 2020 07:51:33 GMT

By saying "disabled", we see through GAIA that the port is not enabled and it has no physical connection to the rest of the infrastructure.

Its main purpose is to function as an out-of-band mgmt, if the connectivity to the actual management interface is not permitted, so you are right in stating that it is not the actual management interface.

The ping was performed from outside the firewall (user PC).

Re: Disabled Mgmt interface of firewall responds to ping

PhoneBoy — Fri, 22 May 2020 19:20:26 GMT

Disabling the interface does not deassociate the IP address assigned to that interface from the appliance.
As such, if a ping for a disabled interface is received on a different interface, the appliance will respond to it.
This is expected behavior.