About Rboehme

From the description I understood he wants to ping his own gateway. Therefore there is no policy needed. (intra-zone).   Is traffic from inside vlan.101 accepted and processed by the firewall? ... View more

Hi James,   from my point of view there is no downsite. If your ruleset is appropriate there is no reason to let the intra-/inter-zone Default rules not log events. As mentioned by other user you can have a deny/any/any rule before the default rules but this is basically only useful if you have setup policies for everything. Imagine some customer/partner wants to setup a VPN with your outside interface. As he is based within the outside zone as well as your outside interface this would normally hit the "intra-zone default rule" - which can not being hit when a deny/any/any statement is placed before.   The best practice is to set logging to "at session end" and you can safely enable the logging on those rules as I do primarily assume you do not want this rule to be it but when it gets hit you want to see it in the logs.   Kind regards, Rene ... View more

Dear CRDF18,   please try the following steps:   SSH into FW2 sourcing from FW1 (just connect and accept the key) SSH into FW1 sourcing from FW2 (just connect and accept the key) Enable HA1 encryption again and let us know the outcome 🙂   Kind regards,   Rene   ... View more

Dear Trancefor,   thank you for your answer. I am confused by this:   Usually four LDAP servers are more than enough to authenticate all the users in the domain, and to provide redundancy in case a LDAP server goes down.   This sounds like:"Hey, I will use one LDAP forever, if it goes down, I just will pick the next in the list".   Sometimes, larger companies have more than four LDAP servers with distributed environments in which users connect to dedicated LDAP servers. Users may contact LDAP servers that are not one of the four servers, and will try to authenticate to them.   So this sounds to me like (if the first statement above is true):"Hey I will use the first LDAP server of the first entry of the authentication sequence. If this authentication fails, I will contact the first LDAP server of the second entry of the authentication profile."   Bascially if you have two groups of LDAP servers:   Group1: 1,2,3,4 Group2:5,6,7,8 Authentication Sequence: Group1,Group2   Assuming no LDAP server goes down ever: LDAP1 will be contacted and LDAP5 might be contacted, the rest of the server will never be contacted. Am I right here?   Kind regards, Rene ... View more

Actually what you can to is:   - attach your trust interface to the VR - attach your untrust interface to the VR - go to the CLI and enter "ping source <ip-of-trust-interface> host <ip-of-host-in-untrust-zone>   A setup like this would normally be trust (LAN) to untrust (internet) so in my case it would be:   ping source 192.168.0.1 host 8.8.8.8   If the ping succeeds you know that your VR is working.   ... View more