Link to home
Start Free TrialLog in
Avatar of DjJohnny
DjJohnny

asked on

2 Sonicwall NSN 2400s Taking Down Network When Both Are Pluged In

Hi Experts,
I have a customer that I am replacing there existing firewalls with 2 NSA 2400s. I set one up with no problem ,it is connected to a new T1  threw X1 port and to the internal network threw X0 port and then into one on the network switches. There are 4 Cisco network switches that are linked together. When I setup the other NSA 2400 and connect it to the network we start to have problems with the network. What happens is every so often you will see the activity light on both firewalls X0 port blink very fast and if you try to ping another IP on the network it times out. Also all the workstations on the network lock up there web activity. If I disconnect any one of the X0 ports it clears up.
Thank You,
John
Avatar of dpk_wal
dpk_wal
Flag of India image

Two questions:
1. Are you implementing redundancy or high-availability.
2. Does both the firewalls have same internal IP address, causing an IP conflict and hence the issue.

Please advice.

Thank you.
Avatar of DjJohnny
DjJohnny

ASKER

Thank You ,
"Are you implementing redundancy or high-availability" - No
"Does both the firewalls have same internal IP address, causing an IP conflict and hence the issue" No.

The firewalls are being used as 2 different gateways. They seem to work fine together for a while and then they fail. Can be 1 minute or could take a hour or two. Around a certain time each day it will happen as soon as I plug them both in,
I just did a packet sniffer and found a lot of ARP requests. What is a ARP request and how dose the firewall use this information. If there are more then 1 firewall will this cause a problem The network has 3 Cisco Pix that are being used as gateways. These are the ones we will replace once things are stable.
ARP - Address Resolution Protocol is used for MAC address-IP address mapping; this information is used by any networking device to send frames to the correct device.

Just to make sure you only have one default gateway on the machines.

Can you also provide some more information about the IP subnet and other sanitized details from packet capture which you can share.

Thank you.
have you tried reseting the sonicwalls to default installing new firmware and starting the setup wizard from scratch?
Here are the first and last of the packet . The buffer took less then 1 second to fill up
What would you like to know about the Subnet?
--File Index : 1.--
 
--48517 packets captured.--
 
-----Statistics------------
Number Of Bytes Failed To Report:        0
Number Of Packets Forwarded     :        935
Number Of Packets Generated     :        22743
Number Of Packets Consumed      :        526
Number Of Packets DROPPED       :        24291
Number Of Packets Status Unknown:        0
 
*Packet number: 1*
Header Values:
 Bytes captured: 74, Actual Bytes on the wire: 74
Packet Info(Time:03/11/2009 13:50:06.144):
 in:X2*(interface), out:--, Received, 1:4294967
Ethernet Header
 Ether Type: IP(0x800), Src=[00:11:5c:e1:30:21], Dst=[01:00:5e:00:00:0a]
IP Packet Header
 IP Type: EIGRP(0x58), Src=[10.10.10.43], Dst=[224.0.0.10]
EIGRP Packet Header
 EIGRP version : 2, EIGRP message type : 5,EIGRP Checksum : 0
Value:[0]
Hex and ASCII dump of the packet:
 01005e00 000a0011 5ce13021 080045c0 003c0000 00000258 *..^.....\.0!..E..<.....X*
 c36b0a0a 0a2be000 000a0205 f0e40000 00000000 00000000 *.k...+..................*
 00000000 fde80001 000c0100 01000000 000f0004 00080c03 *........................*
 0102                                                  *..                      *
 
*Packet number: 2*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 13:50:06.144):
 in:X2*(interface), out:--, Consumed, Module Id:46, 1:0)
Ethernet Header
 Ether Type: ARP(0x806), Src=[00:13:20:0b:b2:d8], Dst=[ff:ff:ff:ff:ff:ff]
ARP Packet:
 ARP TYPE: ARP Request
 Sender MAC Address: 00:13:20:0b:b2:d8
 Sender IP Address: 10.10.10.101
 Target MAC Address: 00:00:00:00:00:00
 Target IP Address: 10.10.10.107
Value:[0]
Hex and ASCII dump of the packet:
 ffffffff ffff0013 200bb2d8 08060001 08000604 00010013 *........ ...............*
 200bb2d8 0a0a0a65 00000000 00000a0a 0a6b0000 00000000 * ......e.........k......*
 00000000 00000000 00000000                            *............            *
 
*Packet number: 3*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 13:50:06.480):
 in:X2*(interface), out:--, Received, 1:4294967
Ethernet Header
 Ether Type: IP(0x800), Src=[00:0c:ce:06:13:e1], Dst=[01:00:5e:00:00:02]
IP Packet Header
 IP Type: UDP(0x11), Src=[10.10.10.44], Dst=[224.0.0.2]
UDP Packet Header
 Src=[1985], Dst=[1985], Checksum=0xf9f0, Message Length=24 bytes
Application Header
 Not Known: 
Value:[0]
Hex and ASCII dump of the packet:
 01005e00 0002000c ce0613e1 080045c0 002c0000 00000111 *..^...........E..,......*
 c4c90a0a 0a2ce000 000207c1 07c10018 f9f00003 0001000e *.....,..................*
 02000000 00010000 00000000                            *............            *
 
*Packet number: 4*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 13:50:06.608):
 in:X2*(interface), out:--, DROPPED, Drop Code: 20, Module Id: 46, (Ref.Id: _663_iboemfJodpnjohBsqSfrvftu), 1:0)
Ethernet Header
 Ether Type: ARP(0x806), Src=[00:14:69:71:2e:8e], Dst=[ff:ff:ff:ff:ff:ff]
ARP Packet:
 ARP TYPE: ARP Request
 Sender MAC Address: 00:14:69:71:2e:8e
 Sender IP Address: 10.10.10.1
 Target MAC Address: 00:00:00:00:00:00
 Target IP Address: 10.10.10.201
Value:[0]
Hex and ASCII dump of the packet:
 ffffffff ffff0014 69712e8e 08060001 08000604 00010014 *........iq..............*
 69712e8e 0a0a0a01 00000000 00000a0a 0ac90000 00000000 *iq......................*
 00000000 00000000 00000000                            *............            *
 
*Packet number: 5*
Header Values:
 Bytes captured: 62, Actual Bytes on the wire: 62
Packet Info(Time:03/11/2009 13:50:07.064):
 in:X2*(interface), out:--, Received, 1:4294967
Ethernet Header
 Ether Type: IP(0x800), Src=[00:0c:ce:06:13:e1], Dst=[01:00:5e:00:00:02]
IP Packet Header
 IP Type: UDP(0x11), Src=[10.10.10.44], Dst=[224.0.0.2]
UDP Packet Header
 Src=[1985], Dst=[1985], Checksum=0x87ab, Message Length=28 bytes
Application Header
 Not Known: 
Value:[0]
Hex and ASCII dump of the packet:
 01005e00 0002000c ce0613e1 080045c0 00300000 00000111 *..^...........E..0......*
 c4c50a0a 0a2ce000 000207c1 07c1001c 87ab0000 08030a78 *.....,.................x*
 07006369 73636f00 00000a0a 0afe                       *..cisco.......          *
 
*Packet number: 6*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 13:50:07.128):
 in:X2*(interface), out:--, DROPPED, Drop Code: 1, Module Id: 17, (Ref.Id: _1783_joqvuIppl), 1:1)
Ethernet Header
 Ether Type: 0x26(0x26), Src=[00:19:e7:19:31:06], Dst=[01:80:c2:00:00:00]
Ethernet Type: Unknown
Value:[0]
Hex and ASCII dump of the packet:
 0180c200 00000019 e7193106 00264242 03000000 00008001 *..........1..&BB........*
 000dedb2 cac00000 00178001 0019e719 31008006 02001400 *................1.......*
 02000f00 00000000 00000000                            *............            *
 
*Packet number: 7*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 13:50:07.144):
 in:X2*(interface), out:--, Consumed, Module Id:46, 1:0)
Ethernet Header
 Ether Type: ARP(0x806), Src=[00:13:20:0b:b2:d8], Dst=[ff:ff:ff:ff:ff:ff]
ARP Packet:
 ARP TYPE: ARP Request
 Sender MAC Address: 00:13:20:0b:b2:d8
 Sender IP Address: 10.10.10.101
 Target MAC Address: 00:00:00:00:00:00
 Target IP Address: 10.10.10.107
Value:[0]
Hex and ASCII dump of the packet:
 ffffffff ffff0013 200bb2d8 08060001 08000604 00010013 *........ ...............*
 200bb2d8 0a0a0a65 00000000 00000a0a 0a6b0000 00000000 * ......e.........k......*
 00000000 00000000 00000000                            *............            *
 
*Packet number: 8*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 13:50:07.272):
 in:X2*(interface), out:--, DROPPED, Drop Code: 20, Module Id: 46, (Ref.Id: _663_iboemfJodpnjohBsqSfrvftu), 1:0)
Ethernet Header
 Ether Type: ARP(0x806), Src=[00:08:a1:0c:cd:37], Dst=[ff:ff:ff:ff:ff:ff]
ARP Packet:
 ARP TYPE: ARP Request
 Sender MAC Address: 00:08:a1:0c:cd:37
 Sender IP Address: 10.10.10.135
 Target MAC Address: 00:00:00:00:00:00
 Target IP Address: 10.10.10.201
Value:[0]
Hex and ASCII dump of the packet:
 ffffffff ffff0008 a10ccd37 08060001 08000604 00010008 *...........7............*
 a10ccd37 0a0a0a87 00000000 00000a0a 0ac90000 00000000 *...7....................*
 00000000 00000000 00000000                            *............            *
 
*Packet number: 9*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 13:50:07.912):
 in:X2*(interface), out:--, DROPPED, Drop Code: 20, Module Id: 46, (Ref.Id: _663_iboemfJodpnjohBsqSfrvftu), 1:0)
Ethernet Header
 Ether Type: ARP(0x806), Src=[00:19:b9:c6:e8:05], Dst=[ff:ff:ff:ff:ff:ff]
ARP Packet:
 ARP TYPE: ARP Request
 Sender MAC Address: 00:19:b9:c6:e8:05
 Sender IP Address: 10.10.10.92
 Target MAC Address: 00:00:00:00:00:00
 Target IP Address: 10.10.10.109
Value:[0]
Hex and ASCII dump of the packet:
 ffffffff ffff0019 b9c6e805 08060001 08000604 00010019 *........................*
 b9c6e805 0a0a0a5c 00000000 00000a0a 0a6d0000 00000000 *.......\.........m......*
 00000000 00000000 00000000                            *............            *
 
*Packet number: 10*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 13:50:08.016):
 in:X2*(interface), out:--, DROPPED, Drop Code: 31, Module Id: 26, (Ref.Id: _2333_txGsIboemfJqQlu), 1:1)
Ethernet Header
 Ether Type: IP(0x800), Src=[00:14:22:1a:5b:6f], Dst=[00:19:b9:3d:48:e7]
IP Packet Header
 IP Type: TCP(0x6), Src=[10.10.10.95], Dst=[10.10.10.177]
TCP Packet Header
 TCP Flags = [ACK,], Src=[1433], Dst=[1128], Checksum=0xef7e
Application Header
 Not Known
Value:[1]
Hex and ASCII dump of the packet:
 0019b93d 48e70014 221a5b6f 08004500 00281770 40008006 *...=H...".[o..E..(.p@...*
 ba3c0a0a 0a5f0a0a 0ab10599 0468dd97 c57fe64e 06455010 *.<..._.......h.....N.EP.*
 fd85ef7e 00000000 00000000                            *...~........            *
 
*Packet number: 11*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 13:50:08.016):
 in:X2*(interface), out:--, DROPPED, Drop Code: 31, Module Id: 26, (Ref.Id: _2333_txGsIboemfJqQlu), 1:1)
Ethernet Header
 Ether Type: IP(0x800), Src=[00:17:c5:11:5b:08], Dst=[00:19:b9:3d:48:e7]
IP Packet Header
 IP Type: TCP(0x6), Src=[10.10.10.95], Dst=[10.10.10.177]
TCP Packet Header
 TCP Flags = [ACK,], Src=[1433], Dst=[1128], Checksum=0xef7e
Application Header
 Not Known
Value:[1]
Hex and ASCII dump of the packet:
 0019b93d 48e70017 c5115b08 08004500 00281770 40008006 *...=H.....[...E..(.p@...*
 ba3c0a0a 0a5f0a0a 0ab10599 0468dd97 c57fe64e 06455010 *.<..._.......h.....N.EP.*
 fd85ef7e 00000000 00000000                            *...~........            *
 
*Packet number: 12*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 13:50:08.016):
 in:--, out:X2*, Generated (Sent Out), 0:0)
Ethernet Header
 Ether Type: ARP(0x806), Src=[00:17:c5:11:ee:5e], Dst=[ff:ff:ff:ff:ff:ff]
ARP Packet:
 ARP TYPE: ARP Request
 Sender MAC Address: 00:17:c5:11:ee:5e
 Sender IP Address: 10.10.10.4
 Target MAC Address: 00:00:00:00:00:00
 Target IP Address: 10.10.10.177
Value:[0]
Hex and ASCII dump of the packet:
 ffffffff ffff0017 c511ee5e 08060001 08000604 00010017 *...........^............*
 c511ee5e 0a0a0a04 00000000 00000a0a 0ab10000 00000000 *...^....................*
 00000000 00000000 00000000                            *............            *
 
*Packet number: 13*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 13:50:08.016):
 in:X2*(interface), out:--, Consumed, Module Id:46, 1:0)
Ethernet Header
 Ether Type: ARP(0x806), Src=[00:19:b9:3d:48:e7], Dst=[00:17:c5:11:ee:5e]
ARP Packet:
 ARP TYPE: ARP Response
 Sender MAC Address: 00:19:b9:3d:48:e7
 Sender IP Address: 10.10.10.177
 Target MAC Address: 00:17:c5:11:ee:5e
 Target IP Address: 10.10.10.4
Value:[0]
Hex and ASCII dump of the packet:
 0017c511 ee5e0019 b93d48e7 08060001 08000604 00020019 *.....^...=H.............*
 b93d48e7 0a0a0ab1 0017c511 ee5e0a0a 0a040000 00000000 *.=H..........^..........*
 00000000 00000000 00000000                            *............            *
 
*Packet number: 48510*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 14:00:08.816):
 in:X2*(interface), out:--, Received, 1:4294967
Ethernet Header
 Ether Type: IP(0x800), Src=[00:17:c5:11:5b:08], Dst=[00:1a:a0:ea:ff:00]
IP Packet Header
 IP Type: UDP(0x11), Src=[10.10.10.204], Dst=[10.10.10.136]
UDP Packet Header
 Src=[20770], Dst=[6004], Checksum=0x8ce6, Message Length=16 bytes
Application Header
 Not Known: 
Value:[0]
Hex and ASCII dump of the packet:
 001aa0ea ff000017 c5115b08 08004500 0024c48d 00008011 *..........[...E..$......*
 4cd40a0a 0acc0a0a 0a885122 17740010 8ce6dac9 1d81756c *L.........Q".t........ul*
 73320000 00000000 00000000                            *s2..........            *
 
*Packet number: 48511*
Header Values:
 Bytes captured: 50, Actual Bytes on the wire: 50
Packet Info(Time:03/11/2009 14:00:08.816):
 in:--, out:X2*, DROPPED, Drop Code: 31, Module Id: 26, (Ref.Id: _2333_txGsIboemfJqQlu), 1:1)
Ethernet Header
 Ether Type: IP(0x800), Src=[00:17:c5:11:ee:5e], Dst=[00:1a:a0:ea:ff:00]
IP Packet Header
 IP Type: UDP(0x11), Src=[10.10.10.204], Dst=[10.10.10.136]
UDP Packet Header
 Src=[20770], Dst=[6004], Checksum=0x8ce6, Message Length=16 bytes
Application Header
 Not Known: 
Value:[1]
Hex and ASCII dump of the packet:
 001aa0ea ff000017 c511ee5e 08004500 0024c48d 00008011 *...........^..E..$......*
 4cd40a0a 0acc0a0a 0a885122 17740010 8ce6dac9 1d81756c *L.........Q".t........ul*
 7332                                                  *s2                      *
 
*Packet number: 48512*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 14:00:08.816):
 in:X2*(interface), out:--, Received, 1:4294967
Ethernet Header
 Ether Type: IP(0x800), Src=[00:17:c5:11:5b:08], Dst=[00:1a:a0:ea:ff:00]
IP Packet Header
 IP Type: UDP(0x11), Src=[10.10.10.204], Dst=[10.10.10.136]
UDP Packet Header
 Src=[20770], Dst=[6004], Checksum=0x8ce6, Message Length=16 bytes
Application Header
 Not Known: 
Value:[0]
Hex and ASCII dump of the packet:
 001aa0ea ff000017 c5115b08 08004500 0024c48d 00008011 *..........[...E..$......*
 4cd40a0a 0acc0a0a 0a885122 17740010 8ce6dac9 1d81756c *L.........Q".t........ul*
 73320000 00000000 00000000                            *s2..........            *
 
*Packet number: 48513*
Header Values:
 Bytes captured: 50, Actual Bytes on the wire: 50
Packet Info(Time:03/11/2009 14:00:08.816):
 in:--, out:X2*, DROPPED, Drop Code: 31, Module Id: 26, (Ref.Id: _2333_txGsIboemfJqQlu), 1:1)
Ethernet Header
 Ether Type: IP(0x800), Src=[00:17:c5:11:ee:5e], Dst=[00:1a:a0:ea:ff:00]
IP Packet Header
 IP Type: UDP(0x11), Src=[10.10.10.204], Dst=[10.10.10.136]
UDP Packet Header
 Src=[20770], Dst=[6004], Checksum=0x8ce6, Message Length=16 bytes
Application Header
 Not Known: 
Value:[1]
Hex and ASCII dump of the packet:
 001aa0ea ff000017 c511ee5e 08004500 0024c48d 00008011 *...........^..E..$......*
 4cd40a0a 0acc0a0a 0a885122 17740010 8ce6dac9 1d81756c *L.........Q".t........ul*
 7332                                                  *s2                      *
 
*Packet number: 48514*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 14:00:08.816):
 in:X2*(interface), out:--, Received, 1:4294967
Ethernet Header
 Ether Type: IP(0x800), Src=[00:17:c5:11:5b:08], Dst=[00:1a:a0:ea:ff:00]
IP Packet Header
 IP Type: UDP(0x11), Src=[10.10.10.204], Dst=[10.10.10.136]
UDP Packet Header
 Src=[20770], Dst=[6004], Checksum=0x8ce6, Message Length=16 bytes
Application Header
 Not Known: 
Value:[0]
Hex and ASCII dump of the packet:
 001aa0ea ff000017 c5115b08 08004500 0024c48d 00008011 *..........[...E..$......*
 4cd40a0a 0acc0a0a 0a885122 17740010 8ce6dac9 1d81756c *L.........Q".t........ul*
 73320000 00000000 00000000                            *s2..........            *
 
*Packet number: 48515*
Header Values:
 Bytes captured: 50, Actual Bytes on the wire: 50
Packet Info(Time:03/11/2009 14:00:08.816):
 in:--, out:X2*, DROPPED, Drop Code: 31, Module Id: 26, (Ref.Id: _2333_txGsIboemfJqQlu), 1:1)
Ethernet Header
 Ether Type: IP(0x800), Src=[00:17:c5:11:ee:5e], Dst=[00:1a:a0:ea:ff:00]
IP Packet Header
 IP Type: UDP(0x11), Src=[10.10.10.204], Dst=[10.10.10.136]
UDP Packet Header
 Src=[20770], Dst=[6004], Checksum=0x8ce6, Message Length=16 bytes
Application Header
 Not Known: 
Value:[1]
Hex and ASCII dump of the packet:
 001aa0ea ff000017 c511ee5e 08004500 0024c48d 00008011 *...........^..E..$......*
 4cd40a0a 0acc0a0a 0a885122 17740010 8ce6dac9 1d81756c *L.........Q".t........ul*
 7332                                                  *s2                      *
 
*Packet number: 48516*
Header Values:
 Bytes captured: 60, Actual Bytes on the wire: 60
Packet Info(Time:03/11/2009 14:00:08.816):
 in:X2*(interface), out:--, Received, 1:4294967
Ethernet Header
 Ether Type: IP(0x800), Src=[00:17:c5:11:5b:08], Dst=[00:1a:a0:ea:ff:00]
IP Packet Header
 IP Type: UDP(0x11), Src=[10.10.10.204], Dst=[10.10.10.136]
UDP Packet Header
 Src=[20770], Dst=[6004], Checksum=0x8ce6, Message Length=16 bytes
Application Header
 Not Known: 
Value:[0]
Hex and ASCII dump of the packet:
 001aa0ea ff000017 c5115b08 08004500 0024c48d 00008011 *..........[...E..$......*
 4cd40a0a 0acc0a0a 0a885122 17740010 8ce6dac9 1d81756c *L.........Q".t........ul*
 73320000 00000000 00000000                            *s2..........            *
 
*Packet number: 48517*
Header Values:
 Bytes captured: 50, Actual Bytes on the wire: 50
Packet Info(Time:03/11/2009 14:00:08.816):
 in:--, out:X2*, DROPPED, Drop Code: 31, Module Id: 26, (Ref.Id: _2333_txGsIboemfJqQlu), 1:1)
Ethernet Header
 Ether Type: IP(0x800), Src=[00:17:c5:11:ee:5e], Dst=[00:1a:a0:ea:ff:00]
IP Packet Header
 IP Type: UDP(0x11), Src=[10.10.10.204], Dst=[10.10.10.136]
UDP Packet Header
 Src=[20770], Dst=[6004], Checksum=0x8ce6, Message Length=16 bytes
Application Header
 Not Known: 
Value:[1]
Hex and ASCII dump of the packet:
 001aa0ea ff000017 c511ee5e 08004500 0024c48d 00008011 *...........^..E..$......*
 4cd40a0a 0acc0a0a 0a885122 17740010 8ce6dac9 1d81756c *L.........Q".t........ul*
 7332   

Open in new window

ccpjc,
No I have not. Do you think I should?  They were both in default when I got them and I just added the IP Info on the Networks.
The reason I requested subnet details was to understand how are the things connected.

Frankly looking at packet capture does not help as there are no details as to why the packets were dropped or if there was a MAC/IP address duplication.

Can you elaborate bit on the physical setup of the devices, and if possible with subnet; you might use junk subnets for posting and correlate with your actual subnets later.

Thank you.
Well I will do the best I can. They have there one IT guy who setup the network and he is not the most organized person. From what I can tell, there are four routers/gateways all with the subnet 10.010.10.xxx. There are 4 48 port  Cisco Catalyst 2960 switches that every thing is connected to. I did go into the switches and all the ports are setup as no type. He has half of the workstation's default gateways as 1 of the routers lets say 10.10.10.1 and the others 10.10.10.2 . This was his way of load balancing. There is one computer that has there own gate way of 10.10.10.3. She has a application that takes a lot of band with and needs her own t-1. Some of the workstations have a application that has there own router. From within the application you set the gateway the application uses. I know this is not the most detail description but it is what I know so far. Can you give me a direction to look .
Thank You
John
In this case I do not see any reason why the 2400s would have a problem.

Each 2400 would be configured with its own ISP information, and only a specific set of hosts having a specific 2400 as default gateway would connect. They both would be in the same subnet.
Only reason where we would have a conflict, which should not be the case, is if both the 2400 do proxy ARP for the internal subnet.

In the packet capture, put a filter on source IP [with each 2400 specified], please check if you see ARP request going out for almost all the machines on the internal network.

Please update.

Thank you.
personally since you didn't setup the network and the other guy was messy as can be, I would reset the routers, make sure you take note of any special Access Rules or anything not standard so you can reprogram it in afterwards
Yes I do see ARP request going out for almost all the machines on the internal network
Is your Sonicwal configured in L2 bridge mode or transparent mode.
No it is not set for L2 bridge mode or transparent mode. It is set for static.
It should work then; can you reset the boxes as suggested by other experts and then configure again and check if the problem re-surfaces.

Thank you.
Well we spent all day yesterday troubleshooting this. We brought in a Cisco expert to take a look at the switches. We found the switches that are connected to the Sonicwalls were maxing out the bandwidth. We setup one of the ports on the switch so we could use a sniffer. We set up Wireshark and found that when the problem accrued there was a massive amount of SNMP traffic coming from one server that is being used as a terminal server  and then the Sonicwalls were sending them back out to there destination IP address. I spoke to Sonicwall support and they did verify that this was happening but could not tell me why it would happen. There only suggestion was to create a rule that would block the traffic. As this might solve the problem ,can anyone give me an idea as why this might happen? Creating a rule to block it sounds like a Band-Aid solution. I am not familiar with SNMP.

Thank You
John
ASKER CERTIFIED SOLUTION
Avatar of dpk_wal
dpk_wal
Flag of India image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
We found what was sending the traffic. It was a printer.
Thank you for all your help.
John