I have a Sonicwall TZ-350. X0 is the default LAN with IP 192.168.10.1, and X1 is the WAN. I've set up a second local subnet on X2 with IP 192.168.20.1 for a single NAS device (no switch; the device is plugged directly into the Sonicwall). NAS should have free access to LAN and vice versa, but NAS should have no access to or from the WAN.
In the firewall interface, I can see that the NAS has been assigned an IP address of 192.168.20.99. From a machine on LAN at 192.168.10.99: I can ping 127.0.0.1, 192.168.10.99, and 192.168.10.1. But from 192.168.10.99: I cannot ping 192.168.20.1 or access the NAS at 192.168.20.99.
By request, the configuration file is attached here. (It is too large to include in the body.)
NAS is in its own newly created zone on X2. The following access rules are in place for v4 and v6:
NAS <> LAN, any source/destination/service: allow NAS > NAS, any source/destination/service: allow NAS <> WAN, any source/destination/service: deny NAS <> WLAN, any source/destination/service: deny NAS > DMZ, any source/destination/service: allow NAS < DMZ, any source/destination/service: deny v4 only: NAS > NAS, any source, all X2 management IP, ping/HTTPS mgt/HTTP mgt: allow
The following NAT policies (created by Sonicwall when I set up the zone) are in place for v4 on X2:
The following address objects (also created by Sonicwall) are in place for v4 on X2. Both have zone = NAS and class = default. (There are also some v6 objects.)
v4: X2 IP, details 192.168.20.1/255.255.255.255, type = host v4: X2 Subnet, details 192.168.20.0/255.255.255.0, type = network
Similar objects for the LAN do exist. I still can't ping 192.168.20.1 from a machine on 192.168.10.99, but I can ping NAS at 192.168.20.99. I cannot access the NAS drive any other way, but it is now answering pings. So I am guessing that the problem is not with the firewall.