Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
kadar2
Contributor
Jump to solution

Disabled Mgmt interface of firewall responds to ping

Hi all,

 

we are running R80.30 and we noticed that when we ping the mgmt. interface of the firewall, even though it is not enabled, it responds to ping.

We performed fw monitor -e "host(mgmt_ip),accept;" and run a continuous ping. The request passes the IN interface (iI) and then exits again through the same interface (oO) as expected.

We would have thought that because the mgmt. interface is not enabled, we shouldn't get a response.

 

Can someone explain this behavior?

 

Thank you in advance,

Katerina

0 Kudos
1 Solution

Accepted Solutions
PhoneBoy
Admin
Admin
Disabling the interface does not deassociate the IP address assigned to that interface from the appliance.
As such, if a ping for a disabled interface is received on a different interface, the appliance will respond to it.
This is expected behavior.

View solution in original post

0 Kudos
4 Replies
funkylicious
Advisor

Hi,

If you run a ping directly from the firewall to the mgmt intf when it's in off state, it's normal to respond to ping because locally it doesn't care about the state of the interface, unlike other vendors. From an external device the ping won't/shouldn't work.

 

0 Kudos
Chris_Atkinson
Employee Employee
Employee

How was the interface disabled and what was the source of the ping?

When you say the Mgmt interface note the 'role' can be assigned to another port on the appliance...

 

CCSM R77/R80/ELITE
0 Kudos
kadar2
Contributor

By saying "disabled", we see through GAIA that the port is not enabled and it has no physical connection to the rest of the infrastructure.

Its main purpose is to function as an out-of-band mgmt, if the connectivity to the actual management interface is not permitted, so you are right in stating that it is not the actual management interface.

The ping was performed from outside the firewall (user PC).

 

0 Kudos
PhoneBoy
Admin
Admin
Disabling the interface does not deassociate the IP address assigned to that interface from the appliance.
As such, if a ping for a disabled interface is received on a different interface, the appliance will respond to it.
This is expected behavior.
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events