2

Today I am working on this issue and I would love your ideas.

There is a network with something like this

LAN 1 -- WAN CHANNEL--- LAN 2

The LAN 1 have two segments.

When I make a ping from LAN 1 segment 1 it works like a charm.

When I make a ping from LAN 1 segment 2 I have no ping, but after about 30 seconds of continues ping (ping -t) it start to work perfect. After some time of no activity with the destination host the issue happens again.

Tracing the route packets stops in the last router before the target. This is the first router in LAN 2 after the WAN channel.

In the next screenshot you can see thie issue, the first ping is before a continuos ping and the second one is while continous ping is running.

enter image description here

Thank you in advance

3 Answers 3

2

This can sometimes happen if a ping is crossing a network security device. In some cases, pinging by DNS name will trigger a URL filter in a UTM device. It may take several seconds to get a positive or negative response which cases a delay in ICMP. Once a positive response has been received, then future pings are allowed until a timer expires. That logic depends on how the security policy is set up.

So why would segment 2 be affected and not segment 1? In this theory, it's a rather simple matter of different policies for different segments. Perhaps there is an intentional difference in some kind of security context that is having unintended consequences.

Troubleshooting steps:

  1. Ping LAN 2 from your gateway device itself. See if you can ping from the device using a Segment 2 context.
  2. Capture traffic from both the pinger and pingee, then compare dumps. See how long of a delay there is between when the pinger sends and the pingee receives. If it's mere milliseconds, then there's something wrong with the return trip. If it's 30 seconds, then some device in between is holding the traffic.
5
  • Is it normal that I don't see any other hop between the point of fail and the destination? ¿Should I see here this hop? Apr 25, 2012 at 0:29
  • @RicardoPolo Based on what I understand of your setup, there is nothing between the point of failure and the destination so there should be no hop.
    – Wesley
    Apr 25, 2012 at 0:33
  • So, if there is no hop where is the filtering device? Apr 25, 2012 at 0:45
  • The filtering device is the last hop. Potentially. Since we know nothing about your environment, it don't know if it's a simple DSL modem or a ASA 5520. Whatever is the gateway for LAN 2. Then again, there could also be a transparent filtering device. It's your network, so you know more about its design than me. =)
    – Wesley
    Apr 25, 2012 at 0:47
  • Today I known there is a Fortinet Firewall in bridge mode betweent the last router and the target. I see thie Firewall and it has a rule that allow all trafic from any to any. What more do you recommend me to check? Thank you @Wesley Apr 25, 2012 at 22:36
2

Does your WAN channel include a transparent bridge? I've seen this issue when a transparent bridge is unable to pass ARPs. Check out "learning" mode if this is the case. In my case, I was establishing a pfsense transparent bridge connecting servers with rest of the office LAN using pfsense and had to switch learning mode from being on the outside to the server side (or vice versa - hazy memory).

3
  • @neraora Yes!! There is a transparent bridge just between the router in which the packet stops and the destination Apr 25, 2012 at 12:55
  • @neroaroa can you explain a litte more about this mode? Apr 25, 2012 at 22:32
  • how this is known in platforms like Fortinet? Apr 25, 2012 at 22:32
1

SPANNING-TREE?

If possible check Spanning-tree, if a device in your network is doing spanning-tree it can lead to the fact that the port(s) are put into blocking state. Your switch or router has to follow all the steps: blocking, listening, learning state before it will forward traffic. This is indeed about 30 seconds.

Disable Spanning-tree or configure Portfast on the needed ports can solve the problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .