[ScreenOS] Not able to ping self interface IP, when interface is in non-default VR

Summary:

This article provides a workaround for pinging an interface in a non-default VR.

Symptoms:

If an interface is moved to a non-default VR, self pings to it are not successful, that is, one will not be able to ping its IP source self interface.

Example

The following configuration is set:

set zone name <zone-name>
set vr name <vr-name>
set interface <interface id> zone <zone-name>

ex: set vr name custom
    set zone name custom
    set zone custom vr custom
    set interface zone custom
    set interface ip <x.x.x.x>

Note: A custom zone has been created; however the interface can be in any default zone.

When trying to ping the interface IP address with the source interface as itself, it is unsuccessful and it reports an ICMP timeout.

ping x.x.x.x from interface <interface ip> 

Example
ping 192.168.1.1 from interface eth1/1
Type escape sequence to abort

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 1 seconds from ethernet1/1
.....
Success Rate is 0 percent (0/5)

Cause:

The reason this doesn't work is because the ping to the device is considered management traffic, and it will respond on the default-vr.

Solution:

In this scenario, there is a workaround to check the liveliness of the interface. Create a route from the trust VR towards the non-default VR; then one will able to ping it from the trust VR.

set route <x.x.x.x/y> vr <non default vr name>
ex:
set route 192.168.1.0/24 vr custom

ping 192.168.1.1
Type escape sequence to abort

Sending 5, 100-byte ICMP Echos to 10.141.222.151, timeout is 1 seconds
!!!!!
Success Rate is 100 percent (5/5), round-trip time min/avg/max=0/0/1 ms

Modification History:

2021-03-29: Removed EOL device references

Knowledge Base