Unable to Access/Ping Checkpoint Gateway interfaces.

[AVG13]

We have a CP 6200P/R80.30 in production environment & earlier it was accessible via internal interfaces (HTTPS/SSH ) .But suddenly since last few days internal interfaces are not accessible to ping ,SSH , HTTPS.

While taking tcpdump we can see traffic is hitting CP GW but only SEW flags we could able to see.

Now we could only able to access GW(SSH/HTTPS) via public IP.

What might be a reasons for these type of issue ?How we can resolve this? 

[the_rock]

What do you see in the logs in smart console? Also, when you try this, can you do zdebug command as well? For example, say you are pinging or ssh-ing from 10.10.10.100 IP address, just run this command on the gateway -> fw ctl zdebug + drop | grep 10.10.10.100 and see what you get. Another thing to consider is, can you attempt to revert policy to the time when this did work? I dont know if any changes were made, but something clearly happened since last time it worked.

Any routing changes at all?

Andy

[AVG13]

For fw ctl zdebug output we are not able to see any logs/drops .

In smartconsole we can see accept logs for SSH , Ping traffic going towards internal (checkpoint) interface IP .

In order to revert to old policy we don't know when exactly this has been stopped working.

[the_rock]

Ok, I know this may be extreme step, but to confirm 100% its not policy, are you able to do fw unloadlocal on the gateway and see if issue gets solved? If it does, then there is no doubt its something in policy that was blocking it.

[AVG13]

Thanks for your suggestions .

This firewall is currently in production . So fw unloadlocal is less feasible option . 

Only issue is with monitoring tool not able connect properly & FW admins not able to access it via internal interfaces.

If any issue with firewall policy /packets droped by this FW kernal then should see that logs in Smartconsole , fw ctl zdebug +drop command right ?

Anything else we can try /check for this ?

[the_rock]

Can you attach fw monitor and tcpdump files when you are testing this and also indicate source/dst IP?

Cheers,

Andy

[AVG13]

Please find attached command output.

[the_rock]

I am only assuming now, as you did not fully answer my question, it looks like traffic is "stuck" on eth4.1135 interface. What does this show -> ip r g x.x.x.x

where x.x.x.x is IP you are trying to access.

[AVG13]

Please find attached logs.