Trace Route or Ping from Switch is not reaching destination

[Andrew_Schulz]

Hi,

I have a bit of a strange issue going on. I have HP ProCurve 3500yl switches at my remote sites, when I try to ping or traceroute from the switch to a security zone on my firewall at my data center it does not resolve. However, If I ping or traceroute from a PC at the remote site that is connected to the HP switch, it does resolve to the zone on my firewall.

For example Remote Switch (A) with an IP of 10.0.2.1 ping to DMZ server behind firewall at Data center with an IP of 192.168.0.1 does not resovle.

From PC connected to remote Switch (A) with an IP of 10.0.2.2 ping to DMZ server behind firewall at Data center with an IP of 192.168.0.1 resovles.

Please let me know what more information I can provide to help in solving this.

[Vince_Whirlwind]

Is your problem that your switch is unable to resolve your DMZ Server name, or is the problem that your ping results in a "request timed out"?

[Andrew_Schulz]

I get a request timed out for the ping and when I do a trace it hits my core router in my data center and stops there. Again, clients at the remote site can ping and trace to the server in my DMZ without issue.

[Andrew_Schulz]

Another note: The remote swich can ping (by IP) anything at any other remote site and anything at my datacenter that is not behind my firewall (DMZ, Server Zone, etc.). This most certainly looks like a firewall issue from this perspective. However, when doing a ping from the switch it never gets to the firewall as I do not see traffic from it on my Firewall audit. But I do see the traffic when I do it from the Client.  

Is there a hop limit on the HP?

[Vince_Whirlwind · Accepted solution]

Are you sure the switch is using the IP address you thin it is using?

Is it a layer-3 switch with multiple IP addresses, for example?

[Andrew_Schulz]

Yes, it is a l3 switch and it does have multiple IPs. You are correct, it is or was using a different IP than I thought. I now see that my firewall is blocking the traffic as it is being classified as a spoofing attempt. I am working to resolve that. Thanks.