4

We have a SonicWALL NSA 3500, x4 has 2 VLAN interfaces so x4:v300 and x4:v301. Each VLAN has an IP address: v300 is 192.168.100.1, and v301 is 192.168.101.1.

I then have x4 connected to a layer-2-only switch, configured with ports 1-12 v300 and 13-23 v301, and all 23 ports are tagged port 24, then port 24 is tagged for v300 and v301.

I added a firewall access rule to allow subnets on v300 to talk to v301, and vice versa, but all I can do is ping hosts on either subnet. Nothing else, like SSH or HTTP, works.

Does anyone have any idea why?

7
  • Are the VLANs in the same ZONE? If you can post a sanitized screenshot of the Interfaces page, that may help.
    – Jim G.
    Aug 18 '14 at 23:08
  • They were in the same zone then I separated them to test but got the same result. I will post a screenshot when at work again if no other answers.
    – John
    Aug 18 '14 at 23:21
  • For some reason my screenshot is only taking the top left portion of my screen...weird. Anyways, on the interface page it is: X4 Unassigned, X4:V300 192.168.100.1 255.255.255.0 Static VLAN Sub-Interface. X4:V301 192.168.101.1 255.255.255.0 Static VLAN Sub-Interface. It just baffles me, why does ping work but nothing else? I can't see a rule anywhere that's blocking and I've added a rule to allow anything between the 2 zones.
    – John
    Aug 19 '14 at 13:49
  • This is just a hunch, but can you assign the X4 interface to the same zone as the two VLAN interfaces?
    – Jim G.
    Aug 22 '14 at 16:33
  • I attempted another simple test and it worked so routing is obviously working. I took 2 laptops, 1 on each vlan, and i could get to them no problem. The equipment on the 2 vlans that can't route to eachother is a PBX but I am thinking the installer set the gateway wrong...waiting to hear back from them. I think they took the V301 subnet and assigned the gateway of the V300 subnet, so everything in subnet 192.168.101.0 has a gateway of 192.168.100.1. Is there an easy setup to allow this to work on the sonicwall?
    – John
    Aug 25 '14 at 15:28
1

ICMP (Ping) traffic might be allowed but other types of traffic might not be allowed to communicate to each other. Figure out what type of traffic you need, create access groups, then create access rules that allow those specific types of traffic to communicate between each vlan.

0

If your test is working, it looks like the Sonicwall configuration is good. Verify the gateways on the PBX as you mentioned in the comments.

2
  • Gateways verified to be correct. So my theory is shot...gateway on the 301 vlan is 101.1 and on the 300 vlan is 100.1. Using an L3 Cisco with ip routing on allows connection to work between both vlans no problems, the issue is using just an L2 switch and the sonicwall for routing. I added a static route on the sonicwall, this didn't solve the issue. I am still pointing at it's the PBX with an issue...its a nortel cse1000e system...just makes no sense to me at all since the laptop test worked fine, so unless the sonicwall is dropping vlan info..i don't know.
    – John
    Aug 25 '14 at 16:17
  • since you have the port set for tagged on both vlans, is the PBX configured to tag? Jun 20 '17 at 3:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.