topic Re: pinging ipaddress resolves thru firewall in Operating System - HP-UX

pinging ipaddress resolves thru firewall

Dave Bunting — Tue, 16 Oct 2001 05:59:08 GMT

I tried to ping my L1K box using my L3K box (#ping 195.xxx.xxx.xxx), but i get a different IP address (203.xxx.xxx.xxx) which is my WinNT firewall's IP address, what seemed to be wrong here, I checked using netstat, no 203.x gateway is included in my routing table. I have two lancards, both are up, same IP family (netconf)
But when i tried pinging L3K using the L1K there is no problem, no name resolution done, just straight ping, ip to ip...

Re: pinging ipaddress resolves thru firewall

Stefan Farrelly — Tue, 16 Oct 2001 06:12:09 GMT

If you disable dns resolution on your L1000 box then ping your L3000 does it report the correct IP ? (mv /etc/resolv.conf /etc/resolv.conf.old to disable DNS temporarily) It should.

Have you checked the dns entries for both servers are correct ?
with DNS enabled an nslookup resolves correctly ?

Does netstat -i on both servers report the correct IP address for each interface ?

Some sites setup their firewall to respond to any ping request with the IP registered to the firewall, this is to stop hackers finding out too much info etc. Ours works the same here.

Re: pinging ipaddress resolves thru firewall

Dave Bunting — Tue, 16 Oct 2001 07:12:54 GMT

Thanks Stefan...
For a clearer picture...
(from my machine L3K, ip 195.xxx.xxx.xxx, subnet 255.255.255.0)
# ping 192.xxx.xxx.xxx
PING 192.x.x.x: 64 byte packets
64 bytes from 192.x.x.x: icmp_seq=0. time=3. ms
64 bytes from 192.x.x.x: icmp_seq=1. time=1. ms
64 bytes from 192.x.x.x: icmp_seq=2. time=1. ms
... after several 192s more...
64 bytes from 203.x.x.x: icmp_seq=2. time=1. ms
64 bytes from 192.x.x.x: icmp_seq=2. time=1. ms
64 bytes from 192.x.x.x: icmp_seq=2. time=1. ms

===!!!!!
where does the 203.x.x.x come from? 203.x.x.x is the ip of my firewall
more help needed Stefan... Thanks

Re: pinging ipaddress resolves thru firewall

Stefan Farrelly — Tue, 16 Oct 2001 07:26:53 GMT

Hi Dave,

Wow, a ping changing IP while still running, very impressive! Ive not seen that happen before.

Your gateway (which I guess is the same as your firewall - ours is) is screwing up. Youre going to have to show this to your network/firewall people as in my opinion there is definitely a problem on your firewall/gateway server.

Re: pinging ipaddress resolves thru firewall

Dave Bunting — Tue, 16 Oct 2001 07:34:08 GMT

WHOA!!! good suggestion... Thanks Stefan

Re: pinging ipaddress resolves thru firewall

Anthony deRito — Tue, 16 Oct 2001 16:57:25 GMT

Seems to me that this can only be related to a routing issue. The ICMP packets are evidently being delivered to the destination IP however the gateway is reporting information which it believes to be true. If the firewall is configured to respond with its IP during ICMP requests, it may be worth looking at your firewall configuration.

Is the destination IP over a WAN by any chance? This problem may happen if there is a backup WAN connection and the WAN devices are configured with DDR (Dial on demand routing) over ISDN or the like. In this case, the routers may be flip-floping between the primary and backup routes which happens sometimes when DDR is configured incorrectly. The firewall may be responding with whichever interface IP is valid at the time depending on which link is active. Just a thought.

Tony