Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Ivory

Disabled Mgmt interface of firewall responds to ping

Jump to solution

Hi all,

 

we are running R80.30 and we noticed that when we ping the mgmt. interface of the firewall, even though it is not enabled, it responds to ping.

We performed fw monitor -e "host(mgmt_ip),accept;" and run a continuous ping. The request passes the IN interface (iI) and then exits again through the same interface (oO) as expected.

We would have thought that because the mgmt. interface is not enabled, we shouldn't get a response.

 

Can someone explain this behavior?

 

Thank you in advance,

Katerina

0 Kudos
1 Solution

Accepted Solutions
Highlighted
Admin
Admin

Re: Disabled Mgmt interface of firewall responds to ping

Jump to solution
Disabling the interface does not deassociate the IP address assigned to that interface from the appliance.
As such, if a ping for a disabled interface is received on a different interface, the appliance will respond to it.
This is expected behavior.

View solution in original post

0 Kudos
4 Replies
Highlighted

Re: Disabled Mgmt interface of firewall responds to ping

Jump to solution

Hi,

If you run a ping directly from the firewall to the mgmt intf when it's in off state, it's normal to respond to ping because locally it doesn't care about the state of the interface, unlike other vendors. From an external device the ping won't/shouldn't work.

 

0 Kudos
Highlighted
Employee++
Employee++

Re: Disabled Mgmt interface of firewall responds to ping

Jump to solution

How was the interface disabled and what was the source of the ping?

When you say the Mgmt interface note the 'role' can be assigned to another port on the appliance...

 

0 Kudos
Highlighted
Ivory

Re: Disabled Mgmt interface of firewall responds to ping

Jump to solution

By saying "disabled", we see through GAIA that the port is not enabled and it has no physical connection to the rest of the infrastructure.

Its main purpose is to function as an out-of-band mgmt, if the connectivity to the actual management interface is not permitted, so you are right in stating that it is not the actual management interface.

The ping was performed from outside the firewall (user PC).

 

0 Kudos
Highlighted
Admin
Admin

Re: Disabled Mgmt interface of firewall responds to ping

Jump to solution
Disabling the interface does not deassociate the IP address assigned to that interface from the appliance.
As such, if a ping for a disabled interface is received on a different interface, the appliance will respond to it.
This is expected behavior.

View solution in original post

0 Kudos