Traffic Between interfaces

TimPoulter
TimPoulter
in Firebox - Networking, Multi-Wan, VLAN, NAT, SD-WAN

Just wanted a sanity check, im pretty sure I'm missing something simple

I have a main network on Interface 1 as a trusted interface, this is the main network 192.168.10.x

I have a 2nd network on interface 3 as trusted, this is 10.10.10.x

I am trying to access a nas that I have setup on 10.10.10.10 from 192.168.10.60

I made a policy to allow From 192.168.10.60 to 10.10.10.10 with Any(0) ports (just for testing)

I can ping the gateway of interface 3, 10.10.10.1, and the nas 10.10.10.10

I can see traffic logs allowing traffic from 192.168.10.60 to 10.10.10.10 but then there is 1 denied after about 5-6 allows

2026-10-08 12:35:34 M390-Top Deny 192.168.10.60 10.10.10.10 5001/tcp 64882 5001 SLS-Corp Firebox tcp syn checking failed (expecting SYN packet for new TCP connection, but received ACK, FIN, or RST instead). 471 128 (Internal Policy) proc_id="firewall" rc="101" msg_id="3000-0148" tcp_info="offset 5 A 3276905837 win 516" flags="SR" duration="15 seconds" sent_pkts="1" rcvd_pkts="0" sent_bytes="52" rcvd_bytes="0" Traffic

The only other thing is the Interface 1 has multiple vlans which the 192.168.10.x is on vlan id 1

Comments

  • Bruce_Briggs
    Bruce_Briggs
    edited October 8

    What Fireware version are you running?

    There was an issue with VLAN 1 in a few earlier releases for T115, T125, T145 devices

  • Bruce_Briggs
    Bruce_Briggs

    https://community.watchguard.com/watchguard-community/discussion/4514/beware-using-vlan-1-with-tagged-untagged-for-firebox-t115-w-firebox-t125-t125-w-firebox-t145?utm_source=community-search&utm_medium=organic-search&utm_term=vlan

  • Bruce_Briggs
    Bruce_Briggs

    The deny indicates that Fireware does not have session info which matches that packet, which suggests that a session timeout was reached or one of the devices ended the session.

  • Bruce_Briggs
    Bruce_Briggs

    Dual NICs on the NAS, connected to 2 firewall interfaces?

  • TimPoulter
    TimPoulter

    Hi Bruce,

    The firewall is a M390. I have been aware of that issue on the newer T series, and

    The NAS does have 2 nics yes, but on the 10.10.10.10 is configured with a Gateway, the 2nd nic is IP only with no gateway.

  • Bruce_Briggs
    Bruce_Briggs

    if the 2nd NIC is connected to something, unplug it & test again

Categories