topic Re: The connection between subnets is lost in General Topics

The connection between subnets is lost

Sacmaugacon — Tue, 07 May 2024 21:09:31 GMT

Hi every one,

Now I using CP VM and R77 smart dashboard

I have 2 subnets /24 on 2 eth, open policy any port.

everything appear normal, 2 hosts can ping and telnet each other on any port, but about 30 minutes after, 2 hosts on 2 subnets cant telnet on any port although they can still ping and trace routes each other follow the correct path.

When I reboot FW, every thing works fine again, but issue persists afterward.

I need assistance

Re: The connection between subnets is lost

the_rock — Tue, 07 May 2024 22:59:50 GMT

Do you have simple diagram? Even "paint" will do : - )

Btw, Im sure you know R77 is way out of support, but this appears to be hopefully something simple, lets see. When issue is happening, can you do basic zdebug to see if fw is dropping anything? Is traffic being accepted on desired rule?

Andy

Re: The connection between subnets is lost

PhoneBoy — Tue, 07 May 2024 23:27:26 GMT

Why are using a release that has been End of Support for several years now?
The most current (and recommended) release is R81.20.

Re: The connection between subnets is lost

Sacmaugacon — Wed, 08 May 2024 01:31:55 GMT

for some reasons so I have to use old ver

This is simple topo

Re: The connection between subnets is lost

PhoneBoy — Wed, 08 May 2024 01:44:20 GMT

Where are you doing the 802.1Q trunking here: in VMware or in the VM itself?
I can't imagine the later will go well.
What are the precise specs of the VM you installed? This includes:

Disk space
RAM
Number of CPUs
NIC Driver Types
OS Type (In VMware, specify RHEL 5 for best results)

I would execute a tcpdump from the gateway when the problem is occurring to see if the traffic is actually getting to/from the gateway.

Re: The connection between subnets is lost

Sacmaugacon — Wed, 08 May 2024 03:49:09 GMT

I trunking on uplink server

with VM, 4 cores. 8GB RAM, add 2 Network adapter for 2 vlan 105 and 106.
when the problem is occurring, tcpdump -i eth5 host 10.0.105.105 and host 10.0.106.106, there traffic from 10.0.105.105 but no reply from 10.0.106.106, yet there are no logs on the firewall. icmp still has traffic

Re: The connection between subnets is lost

emmap — Wed, 08 May 2024 04:13:36 GMT

From what you're saying, you're tcpdumping on the egress interface of the C2S side of the connection and not seeing a reply, so the traffic is passing through and leaving the gateway. Troubleshooting needs to move further along the network to see where it's failing.

Re: The connection between subnets is lost

Sacmaugacon — Wed, 08 May 2024 04:57:19 GMT

I try again
When I telnet from 10.0.105.105 to 10.0.106.106
TCP dump on eth2 , there traffic from 10.0.105.105 to 10.0.106.106

TCP dump oneth5, there no traffic from 10.0.105.105 to 10.0.106.106
So is there any issue with the firewall

Re: The connection between subnets is lost

emmap — Wed, 08 May 2024 05:27:30 GMT

Does the command 'fw ctl zdebug drop' work on that version? It's been so long I don't remember. If it does, it should why the gateway is dropping packets.

Re: The connection between subnets is lost

Sacmaugacon — Wed, 08 May 2024 05:45:57 GMT

Expert# fw ctl zdebug drop | grep 10.0.106.106

fw_log_drop_ex: Packet proto=6 10.0.105.105:43571 -> 10.0.106.106:3389 dropped by fw_runfilter_ex Reason: F_INDOM;

So how to fix this bug

Re: The connection between subnets is lost

emmap — Wed, 08 May 2024 05:59:08 GMT

Do you have any domain objects configured / in the policy? If so, try removing them.

Re: The connection between subnets is lost

Sacmaugacon — Wed, 08 May 2024 06:30:56 GMT

tks vrm emmap, it done :)))

Re: The connection between subnets is lost

the_rock — Wed, 08 May 2024 11:10:06 GMT

Was that it?

Re: The connection between subnets is lost

PhoneBoy — Wed, 08 May 2024 22:55:22 GMT

The reason @emmap suggested removing Domain Objects is: https://support.checkpoint.com/results/sk/sk31757
Which is reasonable because I would not recommend using non-FQDN Domain Objects, which were the only option prior to R80.10.