I have an eight port Netgear GS108Tv2 between my firewalls and their gateways. One switch serves my two firewall and the two ADSL and SDSL routers.

One of the firewalls (pfSense) pings its gateway every second. About 50% of the time it reports the gateway being down, for long periods. So, several hours it works, then several hours it doesn't. Sometimes I can still reach the WAN interface of this firewall though the router it considers down (ping and remote HTTPS admin).

It turns out that the replies from the ICMP ECHOs are being sent out of the wrong port by the switch. I see them arriving on the WAN interface of the other firewall. Rebooting the switch makes the problem go away for a while.

The switch is changed from defaults in that port 1 has a PVID of 1 and emits tagged VLAN 9 frames. The other ports are all PVID 9. This allows me access to the WAN network elsewhere on the LAN.

Is it possible my configuration has messed this up, or it is just a broken switch? Maybe they are all like this if VLANs are actually used. The web interface is pretty poor, so I don't have much confidence in it.


We finally got partially to the bottom of this. There was another device on the network with an IP address that conflicted with the firewall sending the pings. However, I still have no explanation as to why the ping responses appeared on a port to which the only connected device is the second firewall. I managed to capture these packets, but I don't think they tell us much. My understanding is that the switch would be making port decisions based on Ethernet addresses, not IP addresses.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.