pfSense not responding to icmp ping from switch

ryansun

@johnpoz No floating rules on pfsense:

No captive portal either.

"I take it that sniff was taken on pfsense lan, it got the ping, it just didn't answer?" - exactly @NogBadTheBad

"Your lan rules on pfsense are any any - could you post a screenshot" - sure:

And then - LAN subnets:

johnpoz

@ryansun said in pfSense not responding to icmp ping from switch:

interface GigabitEthernet1/0/15
spanning-tree portfast edge
channel-group 1 mode active
 !
interface GigabitEthernet1/0/16
spanning-tree portfast edge
channel-group 1 mode active

Port channel - your doing a lagg, did you set this up in pfsense? You didn't mention that in your first post.

So yeah I would remove that and see if your ok, and then if you want to go back to it you can, but lacp needs to be configured in pfsense.

And see no name server listed, so no the switch isn't going to be able to do dns.

edit:
Why would you have multiple networks on your lan source - are you wanting to use this as a transit network? 10.10.10.10 would be pfblocker. But where id the 192.168.1.26 come from?

Your one pfblocker reject rule has some hits to pfb_pri1_v4, does this have rfc1918 space in, that for sure would block the switch from pinging pfsense IP.

ryansun

@johnpoz GigabitEthernet1/0/15 and 16 are not connected to pfsense - do I still need to configure it in pfsense? Uplink is GigabitEthernet1/0/18. Also the issue was there before I configured port channel for those two ports.

Regarding dns - please see my later reply - dns server was received via dhcp, however not responding either.

johnpoz

@ryansun so you have 3 interfaces connect to pfsense? Why? Makes no sense to me to do that unless you have multiple networks configured.. Or want to do vlans over a lag, or lots of clients with lots of bandwidth.. Is your wan over 1gig, if not the lagg just complicates the setup for no benefit other than failover if one of the ports or cable fail.

edit - oh I missed the "not connected part" - doh!!

ryansun

@johnpoz GigabitEthernet1/0/15 and 16 are connected to my NAS, not pfsense. There's only one interface connected to pfsense, which is port 18

johnpoz

@ryansun yeah my bad - miss read.. doh

But where is that 192.168.1.26 IP coming from? Also disable those pfblocker rules.. Can you ping now?

Your going to have to setup a name server on your switch if you want to do dns, I personally wouldn't use dhcp for a switch.. But it should work - just don't see any config for a nameserver, if it got it from dhcp - you would think it should list it ;)

ryansun

@johnpoz
"But where id the 192.168.1.26 come from?" - I misconfigured a virtual ip - should've used 192.168.1.26/24 instead of 192.168.1.26/32. However after correcting it (now LAN subnets shows 192.168.1.0/24 only) the issue is still there

"Your one pfblocker reject rule has some hits to pfb_pri1_v4, does this have rfc1918 space in, that for sure would block the switch from pinging pfsense IP." - Negative. Also if this rule is blocking icmp from lan how could other devices successfully ping pfsense?

johnpoz

@ryansun very true if your pfblocker was block, your other clients wouldn't be able to ping pfsense eitehr.. odd one.. that is the correct mac for pfsense in your arp table?

edit: what are you running pfsense on - that mac shows as

eac AUTOMATION-CONSULTING GmbH

Never heard of them.. You would think it would be a known mac of network interfaces..

ryansun

@johnpoz It is the right mac address. Pfsense is running on a protectli box

johnpoz

@ryansun odd one..

Your not running snort or suricatad by chance? Ie an IPS package of pfsense.

Are you running + version of pfsense and maybe enable the ethernet filtering, ie layer 2 stuff?

Hmmmm?

Are you doing anything with static arp? You say pfsense can ping the switch 192.168.1.4, look in the arp table - is this the correct mac for the switch? But if that was the case - you would still think you would see it in the sniff..

If I had to guess something is blocking pfsense from seeing the ping request, while it shows up on the interface you see it in the sniff - maybe its not going farther up the stack for pfsense to send a response.. Or maybe for whatever reason its sending it out a different interface.. You don't have any vpn correction on pfsense?

And you don't show anything in the log for the icmp being blocked?

ryansun

@johnpoz VPN was the issue! I set up an IPSec site to site tunnel long ago. It turns out the ip address assigned to switch (192.168.1.4) is being used by the vpn tunnel. This also explains the strange behavior that the switch but switch does not show up in arp table in pfsense, even after doing a "fresh" ping.

After assigning switch a different ip, ping and dns are working as expected. Thank you for your help!

johnpoz

@ryansun great! I wouldn't use any sort of tunnel network that overlaps with your local network.. Is the remote network also 192.168.1?

ryansun

@johnpoz No, the remote network is a different subnet. My understanding is that those IPs serve as the "default gateway" to remote subnet, since I use BGP for routing between the local and remote networks. This (I think) was the link I was trying to follow at that time: https://support.oracle.com/knowledge/Oracle%20Cloud/2488578_1.html (Need a free account to access)

stephenw10

Yes it would still conflict if that IP is used as the transport subnet for a routed IPSec tunnel. That's why many services (like AWS) use APIPA addresses for that to prevent any possibility of a conflict.

johnpoz

@stephenw10 sdwan company we used for few customers at last gig used the documentation network...

192.0.2.0/24

For the tunnels to make didn't overlap with sites of the customer network.