Can't ping from firewall to Hosts and from Hosts to firewall and host to host

Question

I have a network which consists of several networks. A Firewall is inside this Network and monitor and controle the traffic between the First Network and the Second Network.

In my First Network are 3 Clients, which can't communicate each other, but they should be. Before I configure the Firewall, i could be able to ping from a Host to the other Host.

So in my Second Network is a Server.

The Clients should be able to talk each other and to talk with the Server, and the firewall should monitor and controle this traffic.

So the first Problem is, that i can't ping from a Client to other Client , or from Client to Server. Since I added the Firewall.

The Second Problem is, that i can't ping my 2 Networks with the Firewall.

Configuration of my Firewall:

Show interfaces: root# run show configuration interfaces

ge-0/0/0 {
   unit 0 {
       family inet {
           dhcp-client;
       }
   }
}


ge-0/0/2 {
   unit 0 {
       family inet {
           address 10.10.10.1/24;
       }
   }
}

ge-0/0/3 {
   unit 0 {
       family inet {
           address 10.10.20.1/24;
       }
   }
}

---

show security

root# show security

policies {
   default-policy {
       permit-all;
   }
}

zones {
   security-zone ServerZone {
       tcp-rst;
       host-inbound-traffic {
           system-services {
               all;
           }
   }
    interfaces {
        ge-0/0/3.0 {
            host-inbound-traffic {
                system-services {
                    all;
                    ping;
                    http;
                    ssh;
                    https;
                }
            }
        }
    }
}
security-zone ClientZone {
    tcp-rst;
    host-inbound-traffic {
        system-services {
            all;
        }
    }
    interfaces {
        ge-0/0/2.0 {
            host-inbound-traffic {
                system-services {
                    all;
                    ping;
                    http;
                    ssh;
                    https;
                }
            }
        }
    }

If I try to ping a Server or a Client from my Firewall, I get a error: "Destination Host unreachable"

I try to ping from a Client to the other Client in a same network, but I get "Destination Host unreachable" - Error too. and with the command "arp" I get in the HWaddress Column with the Address I tried to ping: "(incomplete)".

Did you maybe know, how I can fix this Problem? I want to Ping from Client to Client, Client to Server, Server to Client, Firewall to Client, Firewall to Server, Server to Firewall and Client to Firewall.

Network Diagramm:

I created this Diagramm by my own. I worke wih a NFX - Device, so everythink is a virtuell Machine. Like the Firewall.

Configuration VSRX - Machine in a NFX - Device

show configuration virtual-network-functions vsrx

type {
   virtual-machine;
}
image {
   /var/third-party/images/media-vsrx-vmdisk-15.1X49-D140.2.qcow2;
   image-type qcow2;
}
virtual-cpu {
   count 2;
   features {
       hardware-virtualization;
   }
}
interfaces eth2 {
   mapping {
       hsxe0 {
           virtual-function;
       }
   }
}
interfaces eth3 {
   mapping {
       vlan {
           members 95;
       } 
   }
}
interfaces eth4 {
    mapping {
       vlan {
           members 98;
       }
    }
}
memory {
   size 4194304;
   features {
       hugepages;
   } 
}
no-autostart;

---

show vlans

Routing instance              VLAN Name          TAG          Interfaces

host -os                      vlan-client        95           VMCentos_eth2.0
                                                              VMDebian_eth2.0
                                                              VMCentos2_eth2.0
                                                              vsrx_eth3.0


host - os                     vlan-server        98           Debian0-Server_eth2
                                                              vsrx_eth4.0

Answer 1

I did not setup the port group.

All nodes that are to share a segment need to be connected to the same port group.

Set up a port group each for the server and one for the clients. Connect each client's vNIC to the clients group and the server's vNIC to the server group. Connect each firewall vNIC to one of the groups.

I'd recommend using a single vSwitch because that's more flexible.

If you want the port groups to use a physical NIC you also need to assign VLAN IDs (or assign different physical NICs - this is required when using multiple vSwitches) and set up the external switch accordingly with a VLAN trunk.