I am having a bit of a strange issue. I have a VMWare ESXi server with two virtual machines running on it. They are running just fine and can communicate on the network without a problem.

I am now trying to add a third. I am installing Ubuntu 8.04 Server. I assign it a static IP address and it's a fresh installation. Once installed I can ping the gateway but I cannot ping the DNS server. It's on the same network with the other two VMs which are communicating just fine. I have tried to reinstall the operating system but it still fails to connect.

Here is /etc/network/interfaces

auto eth0
iface eth0 inet static
    dns-nameservers #opendns
    dns-search mydomain.com 

Here is route

Destination | Gateway     | Genmask       | Flags | Metric | Ref | Use | Iface
localnet    | *           | | U     | 0      | 0   | 0   | eth0
default     | |       | UG    | 100    | 0   | 0   | eth0

Since I'm running this behind a FortiGate this is what the sniff command gives me when I try to ping

arp who-has tell
arp reply is-at MAC -> icmp: echo request -> icmp: echo request -> icmp: echo request -> icmp: echo request -> icmp: echo request

As you can see it looks like I never get a response. One interesting thing I notice is the arp reply's MAC doesn't look right. I have cleared the FortiGate's ARP cache though and checked the entry and it seems correct. The MAC it lists is the one for the router. However if I ping from a different virtual machine that is also Ubuntu 8.04 with a nearly identical configuration I get this. -> icmp: echo request -> icmp: echo reply -> icmp: echo request -> icmp: echo reply -> icmp: echo request -> icmp: echo reply

So, what could I be missing?


arp who-has tell
arp reply is-at MAC

the arp reply's MAC doesn't look right. ... The MAC it lists is the one for the router

As it should. The VM asked for the MAC address of the router.

I'm guessing something on the FortiGate is setup wrong.

Can you swap the addresses on and one of two things will happen:

  1. The problem follows .22
  2. .22 works on the other machine and the new machine does not work with .23 either

also, can ping can ping I'm sure they can, but every bit of information helps.

one more thing, does that sniff command on the Fortigate let you specify the interface? Can you do a capture on the external interface?

you should see something like

your.ip.address. -> icmp: echo request -> your.ip.address: icmp: echo reply
  • Watching the external interface I see nothing pinging from .23. Pinging from .22 I see the expected result. – Nathan Palmer Jan 11 '10 at 3:05
  • You were right. If I swap IPs it works. Is swapped .20 with .23 (.22 is live can I can't change it right now.) The previously unworking machine started working and the working machine stopped working. What does this tell me though other than a router problem? – Nathan Palmer Jan 11 '10 at 3:09
  • Have you checked the ARP cache on the switch, router, and firewall? Can you ping from the router or firewall to .23? Is there a rule on the firewall that's blocking outbound traffic from .23? – joeqwerty Jan 11 '10 at 3:12
  • The ARP cache looks ok. I have even tried to clear it. I cannot ping from the router to .23. The rules are the same for both .20 and .23 and there is one rule that is switch -> wan1 for external traffic. I don't have a wan1 -> wan1 rule however. – Nathan Palmer Jan 11 '10 at 3:16
  • 1
    I don't think the problem is with NIC Teaming in this case. From the sniff on the Fortigate we know that: the icmp packet is making it from the VM to the Fortigate. The icmp packet is NOT making it from the internal interface on the Fortigate to the external Interface. I believe this points to a problem with the rules in the Fortigate. – Justin Jan 11 '10 at 12:28

I found the problem. The issue was how the SSL VPN was setup. I had configured the VPN to use the same IP range. So for example I had configured the regular local network to be

Then I configured the SSL to have the range of


When that happened it also put in a default gateway of for the ssl vpn. So in order to fix my problem I assigned the SSL VPN to use this


Then I changed the default gateway for that to be Everything worked fine after that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.