topic Re: Routing problem. in General Topics

Routing problem.

Matlu — Mon, 27 Feb 2023 18:33:20 GMT

Hello, team.

I have a question.

I have a route created in 1 GW, to reach an IP.

The command netstat -rn, tells me that the route is created correctly, since the traffic to reach that particular destination, must be reached by the ETH5.

The problem is that when I check with the command "ip route get 10.49.2.218", to see where the traffic is actually going out, this command tells me that the traffic is going out on ETH1, and I find it super weird. (Obviously, the connectivity test is not satisfactory).

P.S.: Eth1 is the interface to the Internet.

I have version R80.40 with JHF 180.

Any idea why this could happen?

Regards.

Re: Routing problem.

Sorin_Gogean — Mon, 27 Feb 2023 18:36:54 GMT

Hello,

You have a Routing problem as the 10.49.2.0/26 doesn't cover the 10.49.2.218 you're looking to get to.

An /24 would cover but not as it set today, so your assumptions are wrong.

Enjoy,

Re: Routing problem.

the_rock — Mon, 27 Feb 2023 18:44:05 GMT

I think @Sorin_Gogean is right...

Re: Routing problem.

the_rock — Mon, 27 Feb 2023 19:10:37 GMT

By the way, I think its related to your post from couple of weeks back? : - )

https://community.checkpoint.com/t5/Security-Gateways/Problem-with-SYNC-Interface/m-p/171796#M31196

Here is my message...all the Spanish I learned in Paraguay and Argentina, haha

Si hay un problema amigo, consique una margarita...so true : - ))

Re: Routing problem.

Matlu — Mon, 27 Feb 2023 19:26:44 GMT

Hello,

I am going to try your recommendation, hopefully I will get success.

I will change the segment with /26 for a /24, and according to your theory, this should work, right?

I will try it, and let you know the results.

Cheers.

Re: Routing problem.

Matlu — Mon, 27 Feb 2023 19:28:35 GMT

Hi, Buddy 😄

Exactly, it's related to my penultimate post. HAHA.

The client is a chaos, and now we are "shielding" the Firewall, before they "burn" it, HAHA.

Cheers

Re: Routing problem.

the_rock — Mon, 27 Feb 2023 19:28:41 GMT

100% it would cover that IP address.

Re: Routing problem.

the_rock — Mon, 27 Feb 2023 19:31:08 GMT

HAHAHA...fair enough ; - ). You may need more than 1 margarita in that case lol

Re: Routing problem.

Sorin_Gogean — Mon, 27 Feb 2023 20:25:26 GMT

Hi,

Honestly I could sound rude for some, but @Matlu if you're not aware what netmask does and how it's applying to routing, then I would recommend to drop the firewall alteration stuff and go and re-read/document on IP and routing.

That was not my recommendation but me pointing the error .

Thank you,

PS: if you do things in production without being able to understand how things are interconnected (I was to say "how things are working") then you need to stop and let others do it...

PS2: if you need to clarify some questions, concern, then ask, but for basics....

Re: Routing problem.

Matlu — Mon, 27 Feb 2023 23:01:48 GMT

Hello,

Thank you for your comments, but I transmit you the "why" these "innocent and silly doubts, perhaps" appear.

It turns out, I have another computer, it is a computer, which has the same route, for the same destination, with the same mask /26, and what is the difference?
That this route, if it "works", if it applies, and if it respects, what is configured.

It turns out that the team that I'm trying now, is a team that had a problem, and "unhooked" from the ClusterXL in which it was.

Then, the routes are being replicated, as they have the equipment that is working.

Do I understand?

I am sharing evidence of the computer that is working well, which is part of a Cluster, and the other computer, for which we are now working, and does not "respect" the routes, well, it is a computer, which is practically, "copying" the Firewall that is good.

I hope to sound more convincing now.

Re: Routing problem.

Chris_Atkinson — Tue, 28 Feb 2023 00:37:34 GMT

But you are not showing the complete routing table from the other device?

The IP address is outside the subnet mask boundary in question, period.

Re: Routing problem.

Matlu — Mon, 27 Feb 2023 23:30:12 GMT

Hello,

In the shared images, this is the difference.

The equipment that works well, and the one that is failing, both have the same path, with /26.

In 1 of them, the route, if it works, in the other one, NOT.

Greetings.

Re: Routing problem.

the_rock — Mon, 27 Feb 2023 23:49:26 GMT

I remember you showed me same over remote session and screenshots you sent via email, but guys are right, it is WRONG and subnet should be fixed. Why it works on the other member, I have no clue, but again, its incorrect.

Re: Routing problem.

Chris_Atkinson — Mon, 27 Feb 2023 23:58:40 GMT

show the full table for comparison or atleast expand your grep to the next octet...

Re: Routing problem.

Matlu — Tue, 28 Feb 2023 00:08:10 GMT

I just did the test, Andy.

Yes it works, changing the "/", now the route, in the bad GW, has the /24, and yes I have connectivity.

The problem and my existential doubt is, why in the Firewall that is working fine now, if it works with the /26?

Is it to pull your hair out?

HAHAHA.

What the hell 😄

Re: Routing problem.

the_rock — Tue, 28 Feb 2023 00:11:29 GMT

Well, not to sound ironic now, but lots of things that are not supported sometime work, but still does not mean thats the way it should be. Same if you told me "This worked yesterday", my answer to you would be as to anyone else "Thats right, and I was day YOUNGER yesterday" 😉

Andy

Re: Routing problem.

Sorin_Gogean — Tue, 28 Feb 2023 06:12:26 GMT

Hello @Matlu ,

Sorry but your previous questions are not so innocent, since in my eyes shows lack of knowledge on network side.

Don't get me wrong, but IP and Netmask are bread-and-butter in networking, I really hope someone can prove me otherwise 😊, therefore I can't accept it.

Now on the routes, YOU CLEARLY DON'T HAVE SAME ROUTES ON THOSE BOXES (sorry for shouting), I mean really, on the WORKING box you show 3 routes while looking for the 10.49.2 (from which 2 are in discussion) and on the FAILING box you only have one... It's clearly visible right there.

Now with all those facts, and with you stating "Yes it works, changing the "/", now the route, in the bad GW, has the /24, and yes I have connectivity." strengthens my doubts, that you're not clear what are you doing there. So please either COMPARE and REPLICATE the routes between boxes, and take the WORKING box as reference, but don't add things that you don't know the impact of....

Thank you,

PS: I would "pull my hair out" for lack of knowledge, or due to that....

PS2: honestly, go back and gain knowledge to the bread-and-butter, it's good for you, not for me as I have my own baggage and learning path, since I started 😁

PS3: routes on GAIA do not replicate and you have to maintain them on both boxes....

PS4: get me a topology map and I could tell you more, as there are some things that doesn't make sense right now in this whole story with the SYNC and all others....

Re: Routing problem.

the_rock — Tue, 28 Feb 2023 12:29:29 GMT

Also, keep in mind, @Matlu has to use Google translate to translate from Spanish into English, so that makes it way more difficult to explain all this. He is a good guy, I got many emails from him about this issue, its not easy when end customer does not provide everything thats needed.

Re: Routing problem.

Sorin_Gogean — Tue, 28 Feb 2023 12:46:55 GMT

@the_rock , yes I got that, still the pictures shows exactly what's what, and initially I thought he missed seeing them, due to reasons (tiredness or smth else) but still coming 2nd and 3rd time with "basic" questions, those are red-flags for me.

I'm not doubting that we're all good guys, and well intentioned, but in some cases it's not about that 😊.
Always, I'll help and talk/guide base on things I encountered through time, no issues there, as I'm also asking for others to support 😁.

As for missing information from customer side, that is understandable, and you'll have to do your best with what you have , I totally get that .

Re: Routing problem.

the_rock — Tue, 28 Feb 2023 12:55:02 GMT

I get all you are saying...