1

I have a network which consists of several networks. A Firewall is inside this Network and monitor and controle the traffic between the First Network and the Second Network.

In my First Network are 3 Clients, which can't communicate each other, but they should be. Before I configure the Firewall, i could be able to ping from a Host to the other Host.

So in my Second Network is a Server.

The Clients should be able to talk each other and to talk with the Server, and the firewall should monitor and controle this traffic.

So the first Problem is, that i can't ping from a Client to other Client , or from Client to Server. Since I added the Firewall.

The Second Problem is, that i can't ping my 2 Networks with the Firewall.

Configuration of my Firewall:

Show interfaces: root# run show configuration interfaces

ge-0/0/0 {
   unit 0 {
       family inet {
           dhcp-client;
       }
   }
}


ge-0/0/2 {
   unit 0 {
       family inet {
           address 10.10.10.1/24;
       }
   }
}

ge-0/0/3 {
   unit 0 {
       family inet {
           address 10.10.20.1/24;
       }
   }
}

show security

root# show security

policies {
   default-policy {
       permit-all;
   }
}

zones {
   security-zone ServerZone {
       tcp-rst;
       host-inbound-traffic {
           system-services {
               all;
           }
   }
    interfaces {
        ge-0/0/3.0 {
            host-inbound-traffic {
                system-services {
                    all;
                    ping;
                    http;
                    ssh;
                    https;
                }
            }
        }
    }
}
security-zone ClientZone {
    tcp-rst;
    host-inbound-traffic {
        system-services {
            all;
        }
    }
    interfaces {
        ge-0/0/2.0 {
            host-inbound-traffic {
                system-services {
                    all;
                    ping;
                    http;
                    ssh;
                    https;
                }
            }
        }
    }

If I try to ping a Server or a Client from my Firewall, I get a error: "Destination Host unreachable"

I try to ping from a Client to the other Client in a same network, but I get "Destination Host unreachable" - Error too. and with the command "arp" I get in the HWaddress Column with the Address I tried to ping: "(incomplete)".

Did you maybe know, how I can fix this Problem? I want to Ping from Client to Client, Client to Server, Server to Client, Firewall to Client, Firewall to Server, Server to Firewall and Client to Firewall.

Network Diagramm:

Network Diagramm

I created this Diagramm by my own. I worke wih a NFX - Device, so everythink is a virtuell Machine. Like the Firewall.

Configuration VSRX - Machine in a NFX - Device

show configuration virtual-network-functions vsrx

type {
   virtual-machine;
}
image {
   /var/third-party/images/media-vsrx-vmdisk-15.1X49-D140.2.qcow2;
   image-type qcow2;
}
virtual-cpu {
   count 2;
   features {
       hardware-virtualization;
   }
}
interfaces eth2 {
   mapping {
       hsxe0 {
           virtual-function;
       }
   }
}
interfaces eth3 {
   mapping {
       vlan {
           members 95;
       } 
   }
}
interfaces eth4 {
    mapping {
       vlan {
           members 98;
       }
    }
}
memory {
   size 4194304;
   features {
       hugepages;
   } 
}
no-autostart;

show vlans

Routing instance              VLAN Name          TAG          Interfaces

host -os                      vlan-client        95           VMCentos_eth2.0
                                                              VMDebian_eth2.0
                                                              VMCentos2_eth2.0
                                                              vsrx_eth3.0


host - os                     vlan-server        98           Debian0-Server_eth2
                                                              vsrx_eth4.0
7
  • Please add a diagram for your network setup. You're likely not connecting the servers and clients directly to the firewall. Please include the switch config as well. – Zac67 Sep 24 '18 at 9:01
  • @Zac67 I hope that's what you imagined – Mustafa Sep 24 '18 at 9:18
  • @Zac67 I have no switch. I have this, what you see in the image. – Mustafa Sep 24 '18 at 9:25
  • I was wondering how your connect multiple nodes to a single firewall port - apparently, you're using a vSwitch. The firewall is a vSRX? What's the port group setup? – Zac67 Sep 24 '18 at 9:34
  • Yes the Firewall is a vSRX in a NFX - Device. I use different Interfaces, like a router. I did not setup a port groupe. I get with show route, this output: 10.10.10.0/24 *[Direct/0] 01:40:19 > via ge-0/0/2.0 10.10.10.1/32 *[Local/0] 01:40:19 Local via ge-0/0/2.0 10.10.20.0/24 *[Direct/0] 01:40:19 > via ge-0/0/3.0 10.10.20.1/32 *[Local/0] 01:40:19 Local via ge-0/0/3.0 Sorry I am new in this topic... – Mustafa Sep 24 '18 at 9:45
2

I did not setup the port group.

All nodes that are to share a segment need to be connected to the same port group.

Set up a port group each for the server and one for the clients. Connect each client's vNIC to the clients group and the server's vNIC to the server group. Connect each firewall vNIC to one of the groups.

I'd recommend using a single vSwitch because that's more flexible.

If you want the port groups to use a physical NIC you also need to assign VLAN IDs (or assign different physical NICs - this is required when using multiple vSwitches) and set up the external switch accordingly with a VLAN trunk.

5
  • How can i setup the port group..? – Mustafa Sep 24 '18 at 9:59
  • I had the impression you're using an ESXi host, but you didn't say - what's NFX? – Zac67 Sep 24 '18 at 10:07
  • NFX 250 Device @Zac67 – Mustafa Sep 24 '18 at 10:29
  • I see - funny approach to sell metal dedicated to hosting a virtual firewall. I'm sorry, I'm not familiar with those. However, it seems that platform uses VLANs throughout, so your layout should work. It does seem to use vSwitches as well, so you need to make sure that all VLAN endpoints are located on the same vSwitch. Maybe you could post some details to how the virtual network is set up. – Zac67 Sep 24 '18 at 11:59
  • I added actually in my Question the Configuration from my vsrx virtual-network-functions and my vlans in my NFX - Device. I tried allready to add the Vlans in the vjunos0 but it doesn't work. And it is not logical to do that, because the vjunos0 ist only for a Communication to outside the NFX - Device. – Mustafa Sep 24 '18 at 12:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.