topic Re: ping -a not resolving name anymore in General Topics

ping -a not resolving name anymore

MRamadanAHafiez — Tue, 02 Nov 2021 17:07:07 GMT

Hello Bro,

In our network we used to be in the same vlan of our employees endpoint and we used to use the command ping -a x.x.x.x

to resolve the name of the pinged IP.

after we have moved our PCs "admins" to a different zone, now we can't use this command anymore, the ping is working but the paramenter -a is not getting any names.

knowing that we have a full access to the dns still.

I belive this is firewall matter and as I read ping -a uses some layer 2 staff.

things are not clear, so how to have ping -a getting the names with the command output again?

TIA

Re: ping -a not resolving name anymore

BPry — Tue, 02 Nov 2021 23:50:32 GMT

@MRamadanAHafiez,

This option works perfectly fine through security zones on my firewall without any issues. If this only started happening after you moved these machines into a new security zone, try enabling logging on your interzone-default to ensure your capturing denied traffic and see if anything is getting blocked due to not being included in your rulebase.

Re: ping -a not resolving name anymore

MRamadanAHafiez — Wed, 03 Nov 2021 04:52:25 GMT

Thank you @BPry so much for the reply.

We are not blocked from anything from our new zone, and the monitor logs says nothing denied.

I will double check but if you tell me how ping-a works that may help me resolving it.

Any ideas appreciated.

Re: ping -a not resolving name anymore

aortiz — Wed, 03 Nov 2021 05:24:17 GMT

Was the name resolution working via DNS or Netbios? It’s possible it was Netbios and reason it worked prior to the move.

Re: ping -a not resolving name anymore

MRamadanAHafiez — Wed, 03 Nov 2021 06:54:39 GMT

@aortiz name resolution working via dns no problem after and before zones separation, this is for dns.

But after changing to the new zone ping -a x.x.x.x Not working "was working before Changing zone".

Re: ping -a not resolving name anymore

aortiz — Wed, 03 Nov 2021 23:46:11 GMT

If it worked via DNS and your DNS traffic is not being blocked, then it should still work. I suspect the name resolution was working via Netbios which uses broadcast destination address and most likely not being forwarded across. You can test ping -a from new zone to verify it still works on same broadcast domain and play with nslookups to test DNS.

Re: ping -a not resolving name anymore

Dalidali — Thu, 04 Nov 2021 00:39:06 GMT

Hi, 1. can you check interface setting and its zone protection configuration. It may be possible ping is blocked on interface level.

2. can you check output of tracert and check where it gets dropped . It will give you idea about the hop which comes in between source and destination. You can check all devices if you are sure that PA configuration is fine.

2. Is ping not working for specific subnet or whole network

Re: ping -a not resolving name anymore

BPry — Thu, 04 Nov 2021 13:38:58 GMT

@MRamadanAHafiez,

Offhand I don't know how ping -a functions in the background and whether it uses netbios or DNS for the name resolution. The only thing that I can tell you for sure is that I can do it successfully across security zones without any issues. This is the first time that I've actually even heard of ping -a, and it's not extremely useful personally, but it's perfectly functional across L3 security zones without any issue.

Re: ping -a not resolving name anymore

MRamadanAHafiez — Thu, 04 Nov 2021 15:11:56 GMT

Hi,

I hope any one tell me how this ping -a works.

is it working by querring the name "from the DNS" so I need to have access to the DNS which is already provided.

is it using the netbios name? how to enable this app in the security rules?

"by the way, just now I found the ping -a is working to other zone"

Re: ping -a not resolving name anymore

MRamadanAHafiez — Sat, 06 Nov 2021 20:49:56 GMT

Hello Bro,

After using the packet capture, I have discovered that the commanf ping -a x.x.x.x uses the LLMNR "Linl-Layer Multicast name resolution", Kindly anyone correct me or tell me how to allow this kind of multicast app " abit risky app, but i need to POC it"

Re: ping -a not resolving name anymore

aortiz — Wed, 10 Nov 2021 23:43:05 GMT

Use of LLMNR is not recommended. I suggest you use DNS for name resolution.