Member Avatar for jober

Hi Guys!

I want to seek advice on how to deploy a Firewall Appliance side-by-side with a cisco router. The topology is like this. Cisco Router -> Firewall Appliance -> VLAN SW.

I have already created a transit link between the units. The firewall appliance can see the router interface but the cisco router received reply time out from the appliance.

Thanks in advance!

  • 2 Contributors
  • 1 Reply
  • 317 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by CimmerianX

Dani AI

Generated

For the Router → Firewall Appliance → VLAN‑Switch layout described by , the usual culprits when the firewall "sees" the router but the router gets only timeouts are: L2 adjacency/ARP problems, missing or asymmetric routing, firewall policy (ICMP dropped), interface role/management vs data confusion, NAT or proxy‑ARP behavior, or a VLAN/trunk mismatch on the switch. is correct that many appliances drop ICMP to transit interfaces by default — so ping alone can be misleading.

Basic, ordered checks and useful commands (Cisco IOS examples):

show ip interface brief
show interfaces <if-name> status
show ip route
show arp | include <firewall-ip>
ping <firewall-ip> source <router-int-ip>

If the router has no ARP entry for the firewall IP, it cannot reach it at L2. Use the ping ... source form to force the router to use the interface tied to the transit link. Confirm the firewall has a route back to the router and any downstream networks (or that NAT is configured correctly).

Firewall-side checks and quick packet validation:

  • Confirm the transit interface is in the expected zone/role and not the management-only interface.
  • Verify a policy exists to permit the test flow (even temporarily allow ICMP to validate reachability).
  • Capture on the transit interface (e.g., tcpdump -n -i <if> icmp) to see whether the firewall receives the echo and whether it sends a reply. If traffic arrives but no reply is emitted, the appliance is dropping it by policy or failing ARP/proxy‑ARP.

Common fixes and cautions:

  • Add the missing static route on whichever device lacks a return path (Cisco: ip route <net> <mask> <next-hop>).
  • If the firewall must answer ARP for networks behind it, enable proxy‑ARP or configure appropriate NAT/static ARP.
  • Check switch VLAN tagging and port‑security; mirror the transit port for captures if needed.
  • Never leave a permanent "allow any" rule — use it only for short tests and then revert.

These steps isolate whether the problem is L2, routing, or policy/NAT and will point to the precise corrective action.

Member Avatar for CimmerianX

how are you testing this? You do know if you are pinging the interface, the firewall will drop the packets....

We would need lots more information.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.