Why Can't I Ping the Gateway IP?

If you cannot ping the gateway IP that is defined in the route to the remote firewall, you will need to check the status of the public interface and the route. When verifying connectivity, you will check the Untrust/eth3 interface as well as the routes by using the get interface and get route commands.

To verify the public interface status, perform the following steps:

Open the Command Line Interface (CLI). For more information on how to open the CLI, go to Accessing the Command Line Interface Using Telnet.

Enter    get interface   press ENTER.

In this example, eth3 is the Untrust/public interface and the VLAN State VSD is D, which indicates that the interface is down.

A - Active, I - Inactive, U - Up, D - Down, R - Ready
-------------------------------------------------------------------------------------------------------------
Interfaces in vsys Root:
Name	IP Address	Zone	MAC	VLAN State VSD
eth1	192.168.1.1/24	Trust	0010.db19.a7d0	- U -
eth2	0.0.0.0/0	DMZ	0010.db19.a7d5	- D -
eth3	210.1.1.1/24	Untrust	0010.db19.a7d6	- D -
eth4	0.0.0.0/0	Null	0010.db19.a7d7	- D -
eth5	0.0.0.0/0	Null	0010.db19.a7d8	- D -
eth6	0.0.0.0/0	Null	0010.db19.a7d9	- D -
eth7	0.0.0.0/0	Null	0010.db19.a7da	- D -
eth8	0.0.0.0/0	HA	0010.db19.a7db	- U -
vlan1	0.0.0.0/0	VLAN	0010.db19.a7df	I D -

In this example, eth3 is the Untrust/public interface and the VLAN State VSD is U, which indicates that the interface is up.

A - Active, I - Inactive, U - Up, D - Down, R - Ready
-------------------------------------------------------------------------------------------------------------
Interfaces in vsys Root:
Name	IP Address	Zone	MAC		VLAN State VSD
eth1	192.168.1.1/24	Trust	0010.db19.a7d0		- U -
eth2	0.0.0.0/0	DMZ	0010.db19.a7d5		- D -
eth3	210.1.1.1/24	Untrust	0010.db19.a7d6		- U -
eth4	0.0.0.0/0	Null	0010.db19.a7d7		- D -
eth5	0.0.0.0/0	Null	0010.db19.a7d8		- D -
eth6	0.0.0.0/0	Null	0010.db19.a7d9		- D -
eth7	0.0.0.0/0	Null	0010.db19.a7da		- D -
eth8	0.0.0.0/0	HA	0010.db19.a7db		- U -
vlan1	0.0.0.0/0	VLAN	0010.db19.a7df		I D -

 

To verify the route status, perform the following steps:

Open the Command Line Interface (CLI). For more information on how to open the CLI, go to Accessing the Command Line Interface Using Telnet.

Enter   get route   press ENTER.

In this example, routes ID 6 and ID 3 use interface eth3 and do not have an asterisk before the ID number. This indicates that these routes are inactive. If this is the case for your routes, ensure that all cables are properly connected.

C - Connected, S - Static, A - Auto-Exported, I - Imported, R - RIP, iB - IBGP, eB - EBGP, O - OSPF, E1 - OSPF external type 1, E2 - OSPF external type 2, trust-vr (3 entries)
-------------------------------------------------------------------------------------------------------------
ID	IP-Prefix	Interface	Gateway	P Pref	Mtr	Vsys
6	0.0.0.0/0	eth3	210.1.1.2	S 20	1	Root
*2	192.168.1.0/24	eth1	0.0.0.0	C 0	0	Root
3	210.1.1.0/24	eth3	0.0.0.0	C 0	0	Root

In this example, the routes associated with eth3 are now active because there is an asterisk before each ID number.

C - Connected, S - Static, A - Auto-Exported, I - Imported, R - RIP, iB - IBGP, eB - EBGP, O - OSPF, E1 - OSPF external type 1, E2 - OSPF external type 2, trust-vr (3 entries)
-------------------------------------------------------------------------------------------------------------
ID	IP-Prefix	Interface	Gateway	P Pref	Mtr	Vsys
*6	0.0.0.0/0	eth3	210.1.1.2	S 20	1	Root
*2	192.168.1.0/24	eth1	0.0.0.0	C 0	0	Root
*3	210.1.1.0/24	eth3	0.0.0.0	C 0	0	Root