The connection between subnets is lost

[Sacmaugacon]

Hi every one,

Now I using CP VM and R77 smart dashboard

I have 2 subnets /24 on 2 eth, open policy any port.

everything appear normal, 2 hosts can ping and telnet each other on any port, but about 30 minutes after, 2 hosts on 2 subnets cant telnet on any port although they can still ping and trace routes each other follow the correct path.

When I reboot FW, every thing works fine again, but issue persists afterward.

I need assistance

[the_rock]

Do you have simple diagram? Even "paint" will do : - )

Btw, Im sure you know R77 is way out of support, but this appears to be hopefully something simple, lets see. When issue is happening, can you do basic zdebug to see if fw is dropping anything? Is traffic being accepted on desired rule?

Andy

[Sacmaugacon]

for some reasons so I have to use old ver 

This is simple topo 

[PhoneBoy]

Where are you doing the 802.1Q trunking here: in VMware or in the VM itself?
I can't imagine the later will go well. 
What are the precise specs of the VM you installed? This includes:

• Disk space
• RAM
• Number of CPUs
• NIC Driver Types
• OS Type (In VMware, specify RHEL 5 for best results)

I would execute a tcpdump from the gateway when the problem is occurring to see if the traffic is actually getting to/from the gateway.

[Sacmaugacon]

I trunking on uplink server

with VM, 4 cores. 8GB RAM, add 2 Network adapter for 2 vlan 105 and 106.
when the problem is occurring, tcpdump -i eth5 host 10.0.105.105 and host 10.0.106.106, there traffic from 10.0.105.105 but no reply from 10.0.106.106, yet there are no logs on the firewall. icmp still has traffic

[emmap]

From what you're saying, you're tcpdumping on the egress interface of the C2S side of the connection and not seeing a reply, so the traffic is passing through and leaving the gateway. Troubleshooting needs to move further along the network to see where it's failing. 

[Sacmaugacon]

I try again
When I telnet from 10.0.105.105 to 10.0.106.106
TCP dump on eth2 , there traffic from 10.0.105.105 to 10.0.106.106 

TCP dump oneth5, there no traffic from 10.0.105.105 to 10.0.106.106 
So  is there any issue with the firewall

[emmap]

Does the command 'fw ctl zdebug drop' work on that version? It's been so long I don't remember. If it does, it should why the gateway is dropping packets. 

[Sacmaugacon]

Expert# fw ctl zdebug drop | grep 10.0.106.106

fw_log_drop_ex: Packet proto=6 10.0.105.105:43571 -> 10.0.106.106:3389 dropped by fw_runfilter_ex Reason: F_INDOM;

So how to fix this bug 

[emmap]

Do you have any domain objects configured / in the policy? If so, try removing them. 

[Sacmaugacon]

 tks  vrm  emmap, it done :)))

[the_rock]

Was that it?

[PhoneBoy · Accepted solution]

The reason @emmap suggested removing Domain Objects is: https://support.checkpoint.com/results/sk/sk31757
Which is reasonable because I would not recommend using non-FQDN Domain Objects, which were the only option prior to R80.10.

[PhoneBoy]

Why are using a release that has been End of Support for several years now?
The most current (and recommended) release is R81.20.