Incorrect egress interface when doing ping?
Hi, I have an active-backup firecluster, and connected to WG1 (active) the CORE1 switch and connected to WG2 (backup) the CORE2 switch.
Both switches are connected via a clag.
I have created the VLAN 1000 as transport VLAN between the networks where the switches are the gateway and where the watchguard is the gateway and set as untagged on the interface connecting between the switches and the watchguards.
The IPs would be as follows:
On the watchguard, the VLAN 1000 interface has the IP 10.10.10.105/29.
Core1 has the IP 10.10.10.106/29
Core2 has the IP 10.10.10.107/29
And both cores have a vrrp with the virtual IP 10.10.10.108/29
The default gateway of the cores is the 10.10.10.105
The problem I have is that if I try to do a ping from core1 to the WG IP or to any IP that is routed by the WG, everything works perfect and I don't lose any ping.
If I ping from the WG to the core1 IP, same thing, everything perfect.
But if I do the same test from core2, out of 100 pings, I still get 10 in a row, and then none. In the traffic monitor I see that the ping arrives, so it seems that what it does is not to return.
To clarify that when I make the pings from the CORE, they are presented with the own IP and not the virtual one of the vrrp.
If I make a ping from the WG to the IP of core2, the same thing, of 100 they answer 10 in a row as much, sometimes more or sometimes less.
However, if I activate the advanced options and force the ping to be done from the vlan interface 1000, the 100 pings arrive without problems.
It seems as if Watchguard does not know where to send the traffic back, but only when it is core2 the destination.
I have looked at the ARP table and I see the IPs with the correct macs.
Can anyone tell me what is going on?
Thank you very much.