Sonicwall TZ205 DMZ>LAN communication issues

C

Cmoney90

Weaksauce
Joined
Jul 15, 2007
Messages
84
I have a server (SRV1) in the DMZ that needs to be able to communicate with a server(SRV2) in the LAN. SRV1 is able to ping the DMZ interface but unable to ping the LAN interface. After looking at the logs on the firewall I am seeing "Packet dropped due to policy". So just for testing I made a rule that allowed all DMZ traffic to be able to flow from the DMZ to the LAN. (Note: LAN>DMZ is allowed by default). However, SRV1 is still unable to ping the LAN interface and I am see the same packet drop due to policy in the logs. Has anyone ever seen this issue before?
 
Ping is enabled on both LAN and DMZ interfaces. Like I said before, ping the interfaces is not the problem. When ever I try to ping into the LAN the firewall is dropping the packets.
 
Last edited:
i am not familiar with sonicwall firewalls, but are you sure it doesn't have a separate rule to ignore all ICMP requests (pings) somewhere in there?

You can't ping the server directly? Is the server accepting ICMP pings?

edit: i often use telnet to connect to an ip and a port number to test a tcp/ip connection directly because i often dont trust pings, you can try that directly to your server.

For example: if you want to test your connection to google webserver you connect to www.google.com port 80. If the prompt allows you to type immediately afterward (just try typing something) and then allows you hit enter and shows you a giant HTML dump, then you know you've connected. Otherwise telnet will not let you type immediately, and after a certain period will till you the connection failed (in windows 7 it took 1 minute).

edit2: lol... please excuse me for behing so stupid, its late and i have to go to bed. I didn't read the two posts above me that already go into the ping problem... heh, oh well.
 
Last edited:
Have you set up a route?

I am assuming you are in your DMZ - 10.1.1.5 for instance - and trying to ping something like 192.168.1.10. Since the TZ is technically a router, it needs a route statement to send that traffic from the DMZ to the LAN and vice versa.
 
Check the order the rules are in. If DMZ --> LAN Deny is above the new rule you created it will hit the Deny before it gets to your rule.

Just as a side note, this is not best practice. If I was doing this I would only open just the few ports that need to be opened for the two to communicate (port 80, port 53, whatever), not everything.
 
ianshot said:
Check the order the rules are in. If DMZ --> LAN Deny is above the new rule you created it will hit the Deny before it gets to your rule.

Just as a side note, this is not best practice. If I was doing this I would only open just the few ports that need to be opened for the two to communicate (port 80, port 53, whatever), not everything.
Click to expand...

I actually changed the default deny rule to "allow" so there is no rule in the dmz denying any traffic. The DMZ is not actually in production yet so I am not to worried about it being completely open at the moment.
 
timberdoodle said:
Have you set up a route?

I am assuming you are in your DMZ - 10.1.1.5 for instance - and trying to ping something like 192.168.1.10. Since the TZ is technically a router, it needs a route statement to send that traffic from the DMZ to the LAN and vice versa.
Click to expand...

From what I have seen in the routing table of the sonicwall it seems to automatically create a route for all directly connected networks.
 
serpretetsky said:
You can't ping the server directly? Is the server accepting ICMP pings?
Click to expand...

Yes, the server on the LAN is accepting pings. However, at this point I am not even able to ping the LAN interface on the sonicwall so I am almost certain the problem resides on the sonicwall.
 
Check the order of your rules. Also check your filters. I have never touched a sonicwall, so I'm not sure how exactly they are setup.
 
Cmoney90 said:
I have a server (SRV1) in the DMZ that needs to be able to communicate with a server(SRV2) in the LAN. SRV1 is able to ping the DMZ interface but unable to ping the LAN interface. After looking at the logs on the firewall I am seeing "Packet dropped due to policy". So just for testing I made a rule that allowed all DMZ traffic to be able to flow from the DMZ to the LAN. (Note: LAN>DMZ is allowed by default). However, SRV1 is still unable to ping the LAN interface and I am see the same packet drop due to policy in the logs. Has anyone ever seen this issue before?
Click to expand...

why do you have your server on the dmz ? why isn't the server on it's own port / subnet ?

what version of os is on your unit ? I can help you if you want...
 
dashpuppy said:
why do you have your server on the dmz ? why isn't the server on it's own port / subnet ?

what version of os is on your unit ? I can help you if you want...
Click to expand...

Dash to the rescue! Ok so basically it is an exchange server and needs AD services that are on the LAN. I suggested to keep the client access/mailbox/hub transport inside the LAN and build another VM with the edge transport and through that in the DMZ. Either way I am still having trouble getting the DMZ to communicate with the LAN. I am running SonicOS Enhanced 5.8.1.6-3o
 
Ok, after speaking with sonicwall support the issue turned out to be a routing policy. The default policy created was not configured correctly. Thank you all for your responses!
 
Cmoney90 said:
Ok, after speaking with sonicwall support the issue turned out to be a routing policy. The default policy created was not configured correctly. Thank you all for your responses!
Click to expand...

damit, how am i suppose to shine, if you call those guys GESH! :D:D:D

Glad you have it working now..
 
You must log in or register to reply here.
Back
Top