topic Re: Ping to 1530 GW from internal net dropped in Spark Firewall (SMB)

Ping to 1530 GW from internal net dropped

G_W_Albrecht — Mon, 19 Oct 2020 10:40:05 GMT

Customer has a 1530 SMB appliance in Strict policy mode. He uses a manual rule to enable ping to the GW from internal nets. In firmware R80.20.05 (992001134) this works as expected, but in R80.20.10 (992001491) (and maybe since R80.20.05 (992001208)), ping is dropped by the cleanup rule.

Question now is with R&D : Is this a Bug or just a new Design ?

Re: Ping to 1530 GW from internal net dropped

PhoneBoy — Tue, 20 Oct 2020 02:45:38 GMT

My guess is it’s a bug of some sort.
What does fw ctl zdebug drop say?

Re: Ping to 1530 GW from internal net dropped

G_W_Albrecht — Tue, 20 Oct 2020 07:47:22 GMT

We did not need to ask fw ctl zdebug drop - according to the logs, ping is dropped by the cleanup rule. The rule not working is:

If you substitute the GW object by the GW IP it will match...

Re: Ping to 1530 GW from internal net dropped

G_W_Albrecht — Fri, 23 Oct 2020 08:41:51 GMT

No bug - R&D answered:

Well, for now this is new design. Please use IP based rules for such scenarios.