Netscreen 25 Firewall displays wrong IP addresses

Posted on 2011-04-21
Last Modified: 2012-05-11
I have a Netscreen 25 firewall.

Today I saw a bunch of outgoing traffic on an IP address that I did not have listed as part of our ip block of computers, although it was a valid IP.

Our static IP range is to and it was IP .7

So, I blocked all outgoing traffic on .7 using our firewall.  

Later I got a compliant from a user they could not access the internet.  IP .86 was the IP on their computer.

I am unable to PING .7 or .86.  I then unblocked IP .7 and the computer with IP .86 could again access the internet.

So, my question is, how can a computer be configured to use an IP address .86 that I can not PING AND the firewall thinks is a different IP .7.  Is this an indication that the firewall is bad?
Question by:handyjay
    LVL 18

    Accepted Solution

    There are a few reasons that this could be happening. computer .86 could be proxying traffic through .7. There could also be a route statement sending traffic from .86 through .7, and lastly there could be mapped ips causing this kind of behaviour.

    I think you may have to use netscreen debugging to see whats going on. Try the following to get the debug results. From the command line (i am assuming 192.168.1.x/24 is your network

    set ff src-ip dst-ip <ip of website or other public ip address>
    debug flow basic
    clear db

    Open in new window

    .... start traffic test here. either ping the public ip or surf to website ip specified above

    undebug all
    get db str

    Open in new window

    The results will show exactly where the packets are going. You may want to try with a few different destination ip address and see more results.

    you can do this by doing the following at the command line

    unset ff
    set ff src-ip <ip address> dst-ip <ip address>

    src-ip and dst-ip are in a single command so the firewall knows to debug only traffic that matches both source and destination.
    LVL 9

    Assisted Solution

    When it comes to not bing able to ping, there are a few possibilities. The most likely is a software firewall like the Windows Firewall or one built in to anti-virus software.

    Another thought on multiple ips, does the computer in question have two nics or a wireless and wired connection that both could be on?
    LVL 18

    Expert Comment

    by:Sanga Collins
    just curious:  what was the problem in the end?

    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    Join & Write a Comment

    Suggested Solutions

    Title # Comments Views Activity
    TCP connections per server 12 60
    export data from ASA 5 44
    Sonicwall SSO 11 28
    Host to host VPN issue 1 36
    We sought a budget ($5,000) firewall solution that would provide all the performance we needed with no single point of failure.  Hosting a SAAS web application in our datacenter, it was critical that we find a way to keep connectivity up and inbound…
    Network ports are the threads that hold network communication together. They are an essential part of networking that can be easily ignore or misunderstood, my goals is to show those who don't have a strong network foundation how network ports opera…
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

    731 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now