-
Products
-
SonicPlatform
SonicPlatform is the cybersecurity platform purpose-built for MSPs, making managing complex security environments among multiple tenants easy and streamlined.
Discover More
-
-
Solutions
-
Federal
Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn MoreFederalProtect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn More - Industries
- Use Cases
-
-
Partners
-
Partner Portal
Access to deal registration, MDF, sales and marketing tools, training and more
Learn MorePartner PortalAccess to deal registration, MDF, sales and marketing tools, training and more
Learn More - SonicWall Partners
- Partner Resources
-
-
Support
-
Support Portal
Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn MoreSupport PortalFind answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn More - Support
- Resources
- Capture Labs
-
- Company
- Contact Us
Standby HA Firewall X0 address not reachable from the WAN
12/15/2021 
24 People found this article helpful
489,533 Views
Description
Ping request to Standby Firewall backup IP configured under HA | Monitoring doesn't respond to traffic initiated from WAN side of the Active Firewall.
If we ping the backup IP within the LAN side then we see backup firewall responds to the echo requests but when traffic comes with a source IP address other than LAN subnet where monitoring for Primary and secondary IP addresses has been configured, then it doesn't respond as its a standby unit in HA pair.
Cause
Standby Firewall responds to the traffic arriving on its X0 interface so we can perform source NAT translation on the active firewall for the Traffic coming from WAN side destined for Standby Firewall back up with its Primary X0 IP so when it arrives at the standby firewall it will appear as local traffic and standby firewall will send it back to the active firewall and then it will forwarded back to where it had come from.
Resolution
Two NAT policies will be required on active firewall which will allow access to the standby Unit (Primary of Secondary) IP when traffic is coming from a subnet other than LAN.
CAUTION: Export the Current Firewall settings by navigating to System | Settings | Click on "Export Settings" button.
It's also highly recommend to have a backup which can be used a one touch restore point. Plan and arrange a maintenance window before making the required changes.
This article assumes that Monitoring for X0 has been configured under HA | Monitoring, and Primary and Secondary IPs are configured.
- Navigate to Network | NAT Polices and add the following two NAT Policies:
- After adding the above NAT Policies, ping the standby backup IP from VPN or outside LAN Subnet and expect a echo reply.
- If ping replies aren't being received then check the relevant NAT policy (Depending on which appliance is standby) for it's usage, if no usage is shown, then a restart might be needed by arranging a maintenance window.
Related Articles
- How to Block Google QUIC Protocol on SonicOSX 7.0?
- How to block certain Keywords on SonicOSX 7.0?
- How internal Interfaces can obtain Global IPv6 Addresses using DHCPv6 Prefix Delegation
Categories
- Firewalls > TZ Series
- Firewalls > SonicWall SuperMassive E10000 Series
- Firewalls > SonicWall SuperMassive 9000 Series
- Firewalls > SonicWall NSA Series
YES
NO