• I have been searching and searching with no luck.  I have searched this forum and found people who have had similar issues but either had it magically be resolved or their fix did not work for me.  I am hoping someone is able to help.


    I am unable to ping the opt1 (DMZ) device from any server on its subnet (
    I cannot ping any device from the pfsense firewall that is on that subnet ( 
    I am able to ping from the switch to the servers on that subnet ( 
    I can also ping the switch ip that is on that subnet ( from the switch.
    I can ping the GW IP of from within PFSense firewall. 
    I can also ping the IP IF i add a static route on my linux server to my LAN GW on subnet  (example: ip route add via

    It is as if the cable is not connected to the router from the switch.

    I have reviewed the firewall logs and I don't really see anything that stands out.

    PFsense 2.2.1
    2 intel GB network cards one with a dual port.  I am using LAN, WAN, DMZ (OPT1)
    Summit400-48t (ExtremeWare) switch
    Tagged Vlans created for and
    Switch has 16 ports segregated just for the DMZ vlan 2 which is what this pfsense dmz NIC is cabled to.  The other 33 ports are segregated just for vlan 1 LAN which manages the subnet
    Routing on switch is exactly like the LAN setup except for the IP's have changed for the subnet
    Switch IP
    LAN works fine.
    WAN works fine.

    I have a couple rules in place for DMZ which are
    IPv4 * * * DMZ net * * none
    IPv4 * DMZ net * * * * none

    What I have done so far:
    I have tried different combination of rules and settled for what is above
    I have validated the switch configuration matches the existing working LAN configuration.  Only differences are the subnet's are different since they are separate vlans.
    I swapped out the Ethernet cable
    I swapped out the NIC
    I have tried the DMZ cable in different DMZ designated ports on the switch.
    I have narrowed the test down to a breakdown from the switch to the router and vice versa.  The break is there since I am unable to ping from the switch.

    Odd thing is this used to work fine when i first set it up.  I only tested it with a laptop connected and I had outbound connection.  I never had any servers connected so it sat for 2 months in this configuration not used.  The only thing I did that I can recall is upgrade from 2.1 to 2.2 then to 2.2.1.

    Here is some output from various pings:

    From the switch which has IP

    • Summit400-48t:40 # ping
      Ping(ICMP) 4 packets, 8 data bytes, interval= 1.
      16 bytes from icmp_seq=0 ttl=128 time=0 ms
      16 bytes from icmp_seq=1 ttl=128 time=0 ms
      16 bytes from icmp_seq=2 ttl=128 time=0 ms

    –- ping statistics ---
    3 packets transmitted, 3 packets received, 0% packet loss
    round-trip min/avg/max = 0/0/0 ms

    • Summit400-48t:41 # ping
      Ping(ICMP) 4 packets, 8 data bytes, interval= 1.

    --- ping statistics ---
    4 packets transmitted, 0 packets received, 100% packet loss

    • Summit400-48t:42 #

    From the PFSense router:

    [2.2.1-RELEASE][root@gateway.subspeaz.net]/root: ping
    PING ( 56 data bytes
    64 bytes from icmp_seq=0 ttl=64 time=0.067 ms
    64 bytes from icmp_seq=1 ttl=64 time=0.040 ms
    –- ping statistics ---
    2 packets transmitted, 2 packets received, 0.0% packet loss
    round-trip min/avg/max/stddev = 0.040/0.054/0.067/0.013 ms
    [2.2.1-RELEASE][root@gateway.subspeaz.net]/root: ping
    PING ( 56 data bytes
    ping: sendto: Host is down
    ping: sendto: Host is down
    ping: sendto: Host is down
    –- ping statistics ---
    8 packets transmitted, 0 packets received, 100.0% packet loss

  • Also here are some routing table information to hopefully help:

    PFSense Firewall:

    [2.2.1-RELEASE][root@gateway.subspeaz.net]/root: netstat -rn
    Routing tables

    Destination        Gateway            Flags      Netif Expire
    default        UGS        em2          link#7            UH          lo0    link#3            U          em2      link#3            UHS        lo0    link#4            U          em3        link#4            UHS        lo0    link#2            U          em1        link#2            UHS        lo0


    • Summit400-48t:43 # show iproute

    Ori Destination        Gateway        Mtr Flags      VLAN        Duration
    *d    1  U–----u--- Default    0d:7h:15m:52s
    *d    1  U------u--- DMZ        0d:0h:50m:31s
    *d      0  U-H----um-- Default    0d:7h:15m:52s

    Origin(OR): (b) BlackHole, (bo) BOOTP, (ct) CBT, (d) Direct, (df) DownIF
                (dv) DVMRP, (h) Hardcoded, (i) ICMP, (mo) MOSPF, (o) OSPF
                (o1) OSPFExt1, (o2) OSPFExt2, (oa) OSPFIntra, (oe) OSPFAsExt
                (or) OSPFInter, (pd) PIM-DM, (ps) PIM-SM, (r) RIP, (ra) RtAdvrt
                (s) Static, (*) Preferred route

    Flags: (B) BlackHole, (D) Dynamic, (G) Gateway, (H) Host Route
          (L) Direct LDP LSP, (l) Indirect LDP LSP, (m) Multicast
          (P) LPM-routing, (R) Modified, (S) Static, (T) Direct RSVP-TE LSP
          (t) Indirect RSVP-TE LSP, (u) Unicast, (U) Up

    Mask distribution:
        1 routes at length  8          2 routes at length 24

    Route origin distribution:
        3 routes from Direct

    Total number of routes = 3.

  • Banned

    Post the OPT1 firewall rules screenshot. Also, there's this CODE forum tag (the # button) to post output nicely aligned, instead of this mess.

  • I resolved it.  It turns out there was an issue with tagging on one of the ports on my switch.  It works now.

    Thanks for the reply.