Gateway swap

[K2Technologies]

I have an existing Nokia IP 350 running IPSO 3.8 that I am trying to replace with a Dell 1850 running SPLAT R60 (HFA05).

Each box has its own internal IP address (172.24.1.14 Nokia - 172.24.1.15 SPLAT). The other connections; two for our external Internet connectivity and one for a DMZ are the same between each gateway. When I move the connections to the new gateway, I get nothing. No DMZ connectivity, no Internet access. Sv Tracker appears to be showing the traffic flowing, I've updated my internal core router (Cisco 6509) for the routes to the new gateway and I've even cleared the ARP cache on my edge routers to my ISP. Nothing.

Policy loads fine with no errors - what am I missing to make this change?

[MarioL]

Can you reach the DMZ and out to the internet fine on the new gateway?

The old gateway disconnected when you are testing, right?

[K2Technologies]

No I cannot reach the DMZ hosts or the Internet. I can reach those interfaces on the gateway, but nothing beyond that.

The original gateway is disconnected, I clear the ARP cache on the routers involved and Sv Tracker shows log info that indicates that it is passing the traffic though I get nothing.

[Calumski]

Originally Posted by K2Technologies

No I cannot reach the DMZ hosts or the Internet. I can reach those interfaces on the gateway, but nothing beyond that.

The original gateway is disconnected, I clear the ARP cache on the routers involved and Sv Tracker shows log info that indicates that it is passing the traffic though I get nothing.

Are you getting ARP entries on the edge routers and devices connected to the SPLAT fw?

[K2Technologies]

Yes, I am getting arp entries on the new Gateway

[antonyso88]

I am thinking you may using NAT in your DMZ. How about from your internal to DMZ? Can it accessible? Make sure you have checked the NAT properties option.

Moreover, for simply troubleshooting, i recommend you create a ANY-ANY accept policy to troubleshoot the networking. I think the problem is networking more than the firewall problem.

[K2Technologies]

It works:

I moved the (internal) routes and everything else to the new gateway once again. This time I let it sit and did not switch back after 10 minutes as I had been doing even after clear the arp caches of all the network devices I have access to.

I came back 35 minutes later to find everything passing through the new gateway without issue. I guess all that was needed was patience.

What a pain in the gazooker.