Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today I am working on this issue and I would love your ideas.

There is a network with something like this


The LAN 1 have two segments.

When I make a ping from LAN 1 segment 1 it works like a charm.

When I make a ping from LAN 1 segment 2 I have no ping, but after about 30 seconds of continues ping (ping -t) it start to work perfect. After some time of no activity with the destination host the issue happens again.

Tracing the route packets stops in the last router before the target. This is the first router in LAN 2 after the WAN channel.

In the next screenshot you can see thie issue, the first ping is before a continuos ping and the second one is while continous ping is running.

enter image description here

Thank you in advance

share|improve this question

This can sometimes happen if a ping is crossing a network security device. In some cases, pinging by DNS name will trigger a URL filter in a UTM device. It may take several seconds to get a positive or negative response which cases a delay in ICMP. Once a positive response has been received, then future pings are allowed until a timer expires. That logic depends on how the security policy is set up.

So why would segment 2 be affected and not segment 1? In this theory, it's a rather simple matter of different policies for different segments. Perhaps there is an intentional difference in some kind of security context that is having unintended consequences.

Troubleshooting steps:

  1. Ping LAN 2 from your gateway device itself. See if you can ping from the device using a Segment 2 context.
  2. Capture traffic from both the pinger and pingee, then compare dumps. See how long of a delay there is between when the pinger sends and the pingee receives. If it's mere milliseconds, then there's something wrong with the return trip. If it's 30 seconds, then some device in between is holding the traffic.
share|improve this answer
Is it normal that I don't see any other hop between the point of fail and the destination? ¿Should I see here this hop? – Ricardo Polo Apr 25 '12 at 0:29
@RicardoPolo Based on what I understand of your setup, there is nothing between the point of failure and the destination so there should be no hop. – Wesley Apr 25 '12 at 0:33
So, if there is no hop where is the filtering device? – Ricardo Polo Apr 25 '12 at 0:45
The filtering device is the last hop. Potentially. Since we know nothing about your environment, it don't know if it's a simple DSL modem or a ASA 5520. Whatever is the gateway for LAN 2. Then again, there could also be a transparent filtering device. It's your network, so you know more about its design than me. =) – Wesley Apr 25 '12 at 0:47
Today I known there is a Fortinet Firewall in bridge mode betweent the last router and the target. I see thie Firewall and it has a rule that allow all trafic from any to any. What more do you recommend me to check? Thank you @Wesley – Ricardo Polo Apr 25 '12 at 22:36

Does your WAN channel include a transparent bridge? I've seen this issue when a transparent bridge is unable to pass ARPs. Check out "learning" mode if this is the case. In my case, I was establishing a pfsense transparent bridge connecting servers with rest of the office LAN using pfsense and had to switch learning mode from being on the outside to the server side (or vice versa - hazy memory).

share|improve this answer
@neraora Yes!! There is a transparent bridge just between the router in which the packet stops and the destination – Ricardo Polo Apr 25 '12 at 12:55
@neroaroa can you explain a litte more about this mode? – Ricardo Polo Apr 25 '12 at 22:32
how this is known in platforms like Fortinet? – Ricardo Polo Apr 25 '12 at 22:32


If possible check Spanning-tree, if a device in your network is doing spanning-tree it can lead to the fact that the port(s) are put into blocking state. Your switch or router has to follow all the steps: blocking, listening, learning state before it will forward traffic. This is indeed about 30 seconds.

Disable Spanning-tree or configure Portfast on the needed ports can solve the problem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.