Inter VLAN Routing.

[Johnfnadez]

Hi Merakiers!!

I`ve been trying to block intervlan routing in my outbound firewall rules, but if i perform a ping from my computer in 192.168.22.0/24 to 172.16.101.0/24 but ping suceed.

[PhilipDAth · Accepted solution]

That shouldn't be working.

I'll tell you the way I tend to do it.  I create a group policy per VLAN, assign the group policy to the VLAN, and then apply the firewall rules in the group policy.

It helps break up big firewall rule bases and makes it obvious might network segment the firewall rules are acting on.

[MerakiDave]

Are you pinging the interface IP of the MX itself?  That might still work due to the process flow.  But if the source and destination of the pings are other devices beyond the MX interface itself, I'd open a support case to assist with a packet walk since it should be blocked, and of course make sure there's not some other alternate path apart from the MX itself to get between VLANs.  Also confirm first, via packet capture on the LAN side of the MX, that you are in fact seeing the ICMP traffic ingress and egress.  Also, as a test, create 2 permit statements for the same traffic and place them higher in the list and see if their hit counters increase, then remove them and test again to confirm they're skipping the deny statements somehow.  

[CN]

In addition to what @MerakiDave mentioned, I would try pinging a different device in the other subnet. Or try pinging from a different computer. If you were pinging before you implemented the firewall rule then it will continue to respond to pings and needs time to expire. 

[whistleblower]

but there is an important thing to notice! the difference in using a Group-Policy with Layer3 Firewalling is, that the behavior is stateless while it`s stateful doing it on the firewall page of the Security Appliance!