XG Not pinging another XG

[techie17]

I have two Sophos XG boxes connected to each other via site 2 site VPN and one site A can ping site B XG and hosts on the LAN but site B cant ping site A XG and hosts on the LAN. Does anyone know what the issue could be?

 

Thanks

[localzuk]

Do you have firewall rules in place allowing them to ping?

[techie17]

Do you have firewall rules in place allowing them to ping?

I Have compared the firewall rules with Site C's XG and there are almost identical and site C can ping Site A. What firewall rule should be in place? The strange thing is that clients on Site B can Ping Clients on Site A. Its just the XG that cant ping them (im using the diagnostics page)

[localzuk]

Check the log on the "unpingable" XG box - look for the IP of the pinging XG and see what rule is blocking it.

[techie17]

Check the log on the "unpingable" XG box - look for the IP of the pinging XG and see what rule is blocking it.

Tried that. Does show anything against the IP address of both XG boxes.

[localzuk]

That sounds like you have a rule doing the blocking that doesn't have logging enabled?

[techie17]

That sounds like you have a rule doing the blocking that doesn't have logging enabled?

Yes. logging is enable on all rules. but no entries appear under the firewall log.

[localzuk]

In which case, it might be a rule on the pinging XG box then - blocking the ping leaving the box? Check the logs on that one to see any logged messages FROM it to the other.

[techie17]

In which case, it might be a rule on the pinging XG box then - blocking the ping leaving the box? Check the logs on that one to see any logged messages FROM it to the other.

Nope, nothing. Its really odd. Is there a setting on the XG to prevent the XG from being able to ping? The server and clients at Site A can ping over the VPN absolutely fine.

[localzuk]

Under System -> Administration, take a look in Device Access. Ping/Ping6 is where permissions are set allowing things to ping (its done by zone) that XG box. So, for me, for example, our LAN, WAN and our PTP Zones are allowed to ping, as well as our HA zone.

 

However, that only prevents pinging of the XG box itself - not the zones in the client - that is determined by your firewall rules.