problem with 3 NIC

[kevinchen129]

There is a firewall in a solaris Box, installed 3 NICs.
One NIC as out port(elxl0), two of NIC as inside port(elxl1 and elxl2). elxl0 and elxl1 are working well as a firewall. But I can't ping elxl2 from inside network.(elxl2 is up).
ip address for elxl1 (192.168.0.1), for elxl2 (192.168.0.2).
What's the problem?

Thanks,

 

[bcastner]

Your firewall is blocking ICMP traffic.

 

[kevinchen129]

but I can ping elxl1, firewall configuration for elxl1 and elxl2 is same.

 

[bcastner]

Two thoughts:

1. You client OS firewall is blocking the response. For XP clients this is a common problem. Disable it.

2. Your switch/router is blocking it. Check the router configuration to make certain that ICMP packets are not being discarded by the router.

 

[kevinchen129]

Thanks,
I am trying to use the firewall as a router to connect a
different physical network.
I got following message with using snoop at the firewall host,
# snoop -d elxl2 -V
Using device /dev/elxl (promiscuous mode)
________________________________
192.168.0.5 -> lobby ETHER Type=0800 (IP), size = 74 bytes
192.168.0.5 -> lobby IP D=192.168.0.2 S=192.168.0.5 LEN=60,
ID=16640
192.168.0.5 -> lobby ICMP Echo request (ID: 512 Sequence number:
10752)
________________________________
192.168.0.5 -> lobby ETHER Type=0800 (IP), size = 74 bytes
192.168.0.5 -> lobby IP D=192.168.0.2 S=192.168.0.5 LEN=60,
ID=16896
192.168.0.5 -> lobby ICMP Echo request (ID: 512 Sequence number:
11008)
________________________________
192.168.0.5 -> lobby ETHER Type=0800 (IP), size = 74 bytes
192.168.0.5 -> lobby IP D=192.168.0.2 S=192.168.0.5 LEN=60,
ID=17152
192.168.0.5 -> lobby ICMP Echo request (ID: 512 Sequence number:
11264)
________________________________

I don't know why the elxl2 (192.168.0.2) won't response the request.
the router isn't configured to block ICMP or Telnet.

 

[alixiang]

kevinchen129:
It's look like a route table problem. the route to the
net 192.168.0.0/24 is point to elxl1,so your ICMP request
to elxl2 was responed by elxl1.
You could test this to change the IP address of elxl2 to
a diff sub-net,like 192.168.100.2/24,then link a client with
IP 192.168.100.5/24 to ping elxl2.

Good Luck!

 

[kevinchen129]

I got it.
Thank alixiang