![Contents](../../Resources/Images/red_menu.png)
Related Topics
Troubleshoot Network Connectivity
To test and troubleshoot your network, you can use tools available on your client computer and on your Firebox. For the tests that involve commands issued from a Windows client computer, use a computer on a trusted, optional, or custom network connected to the Firebox.
Network Troubleshooting Tools
Use these tools and methods to test network connectivity and host name resolution on your network. These test methods are referenced in the troubleshooting steps in the next sections.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Locate the search text box in the Windows task bar or Start menu.
- In the search text box, type cmd and press Enter.
The Command Prompt window appears. - At the prompt, type ping [destination IP address or host name] and press Enter.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
You can use the Ping diagnostic task to send ping packets from the Firebox to an IP address or host name.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Select System Status > Diagnostics.
The Diagnostics page appears with the Diagnostics File tab selected. - Select the Network tab.
The Network page appears. - From the Task drop-down list, select the Ping command.
The Address text box appears. - In the Address text box, type an IP address or host name.
- Click Run Task.
The output of the command appears in the Results pane. - To stop the Ping command, click Stop Task.
For more information about diagnostic tasks in Fireware Web UI, see Run Diagnostic Tasks on Your Firebox.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Select Tools > Diagnostic Tasks.
The Diagnostic Tasks dialog box appears, with the Ping IPv4 task selected by default. - In the Address text box, type an IP address or host name.
- Click Run Task.
The output of the command appears in the Results pane.
For more information about diagnostic tasks in Firebox System Manager, see Run Diagnostic Tasks to Learn More About Log Messages.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Locate the search text box in the Windows task bar or Start menu.
- In the search text box, type cmd and press Enter.
The Command Prompt window appears. - At the prompt, type nslookup [destination host name] [optional; DNS server IP address] and press Enter.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
You can use the DNS Lookup diagnostic task to test DNS name resolution from the Firebox to a host.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Select System Status > Diagnostics.
The Diagnostics page appears with the Diagnostics File tab selected. - Select the Network tab.
The Network page appears. - From the Task drop-down list, select DNS Lookup.
The Address text box appears. - In the Address text box, type the host name.
- Click Run Task.
The output of the command appears in the Results pane. - To stop the DNS Lookup command, click Stop Task.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Select Tools > Diagnostic Tasks.
- From the Task drop-down list, select DNS Lookup.
- In the Address text box, type the host name.
- Click Run Task.
The output of the command appears in the Results pane.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
By default, the Firebox does not create log messages for connections that are allowed by packet filter policies such as the Ping policy. It can be useful to enable logging of allowed packets for a policy such as Ping while you troubleshoot network connectivity issues.
Use these steps to edit the logging settings in a policy so that the Firebox creates log messages for connections that are allowed by the policy.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Select Firewall > Firewall Policies.
The Policies page appears. - Click the name of the policy to edit.
The Firewall Policies > Edit page appears. - In the Logging section, select the Send a log message check box.
- Click Save to save the configuration change.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Double click a policy to edit it.
The Edit Policy Properties dialog box appears. - Select the Properties tab.
- Click Logging.
- Select the Send a log message check box.
- Save the configuration to the Firebox.
After you make this change, the Firebox creates log messages for connections allowed by the policy. In Traffic Monitor, you can filter the log messages to see log messages created for connections allowed by a specific policy, or for connections to or from a specific IP address.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Select Dashboard > Traffic Monitor.
- In the filter text box in the top of the page, type the term to search for only the log messages that contain that term. For example, this can be the IP address of a computer on your network, a user name, or the name of the policy for which you enabled logging.
- To remove the filter, click
.
To learn more about the Traffic Monitor Dashboard, see Traffic Monitor.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Select the Traffic Monitor tab.
- In the filter text box in the top of the page, type the term to search for only the log messages that contain that term. For example, this can be the IP address of a computer on your network, a user name, or the name of the policy for which you enabled logging.
- To remove the filter, click
.
To learn more about Traffic Monitor in Firebox System Manager, see Device Log Messages (Traffic Monitor).
To learn more about how to read a log message, see Read a Log Message.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Locate the search text box in the Windows task bar or Start menu.
- In the search text box, type cmd and press Enter.
The Command Prompt window appears. - To see the assigned IP address, subnet mask, and default gateway, at the prompt, type ipconfig and press Enter.
- To see more information, including DNS server IP addresses, type ipconfig/all and press Enter.
Troubleshoot Outbound Connections
To identify the cause of Internet connection problems from computers on your local network, start with ping tests from a local computer on your network to the Firebox or a local server on your network. If that is successful, the next step is to test routing and DNS resolution to hosts outside your local network. Use the instructions in the previous section to run the diagnostic commands used in these tests and to look at log messages.
Test 1 — Ping an Internal IP Address
From your local computer, attempt to ping other internal IP addresses on the same local network. For example try to ping a local network server, or the IP address of a Firebox internal interface. To start a ping from a Windows computer, use the instructions in the preceding section.
If you are unable to ping the internal IP address of the Firebox, this could indicate a problem with the configuration on the Firebox, or a problem with your local network configuration or cabling. To see the IP address and default gateway in local network configuration on a client computer, from the Windows command prompt, use the ipconfig command.
Look at the ipconfig command output and consider these possible causes for the ping failure:
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
In the ipconfig command output on the client computer, look for the IPv4 address assigned to the local computer, and the default gateway IP address. The client computer must have an IPv4 address. In most cases, the default gateway must be the IP address of the internal Firebox interface that the local network connects to.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
If the client computer uses DHCP to get an IP address, and the ipconfig output shows that no IP address is assigned, check the configuration of the Firebox interface the local network connects to. Make sure that DHCP server is enabled and that the DHCP address pool configured for the Firebox interface contains enough IP addresses to assign addresses to all clients that connect.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
If the client computer uses DHCP to get an IP address, and the IP address and gateway assigned on the client do not match the DHCP server settings configured on the Firebox interface this network connects to, it is possible that a rogue DHCP server is on your network and assigned the unexpected IP address.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
Check the configuration of the Firebox interface the local network connects to. Make sure that the interface IP address and subnet mask are correct for your network. For more information about interface IP addresses and subnet masks, see About IP Addresses.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
If there is a switch or router between the client computer and the Firebox internal interface, the switch or router configuration could be the problem. To test whether the switch or router is the problem, connect the client computer directly to the Firebox internal interface, and then try to ping the Firebox again.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
Network connectivity issues can be caused by a damaged or disconnected cable, or a failure of a network interface on the computer, Firebox, or any connected switch or router. To detect this type of problem, look at the link and activity lights on the network interface at each end of each cable, try a different network cable, or try a to test the connection to the Firebox from a different computer on the same network segment.
For information about the indicators on your Firebox interfaces, see the Hardware Guide for your Firebox model.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
If the problem affects all or many users on your network, it could be that there is an IP address conflict between the Firebox internal IP address and another device on your network. To test this, disconnect the cable from the Firebox interface and then try to ping the internal interface of the Firebox from a client computer. If the ping gets a response when the network is not connected to the Firebox interface, some other host on the network uses an IP address that conflicts with the IP address of the Firebox interface.
Test 2 — Ping the Default Gateway of the Firebox
If you can successfully ping the IP address of the Firebox interface, test whether traffic from the client computer can be routed to addresses outside the Firebox. To test this, from your Windows computer attempt to ping the default gateway for the Firebox external interface. This will confirm that your computer can route to a host outside the Firebox, and that your Firebox is configured to allow these ping requests.
You can see the IP address of the Firebox external default gateway in WatchGuard System Manager, or in the Interfaces dashboard in Fireware Web UI.
If your network has an Internet gateway other than the Firebox, Internet-bound traffic from clients on your network might not be routed through the Firebox. To verify that outbound traffic to the Internet goes through the Firebox, enable logging of allowed packets in the ping policy and verify that log messages are created for ping requests from your network. For details about how to do this, see the preceding Network Troubleshooting Tools section.
If your ping to the default gateway of the Firebox external interface fails, check for one of these causes:
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
If your local network does not use one of the RFC 1918 private subnets, the default dynamic NAT rules do not masquerade traffic from your private network to the internet. To see if this could be the issue, look at the log messages for your ping requests. Confirm that the src_ip_nat attribute appears and the listed IP address matches the external IP address of the Firebox.
If your Firebox is configured with Drop-in or Bridge mode, the src_ip_nat attribute does not appear in log messages for outbound traffic.
For more information about dynamic NAT and the default dynamic NAT rules, see About Dynamic NAT.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
To see if this is the cause, search the log messages for denied ping requests. The log message tells you which policy denied the traffic. By default, the Firebox configuration includes a Ping policy that allows outgoing Ping traffic.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
To see if this is the case, connect your computer directly to the Firebox to bypass your internal network. Make sure your client computer has an IP address on the correct subnet to connect to the Firebox, and that the default gateway is set to the IP address of the Firebox interface the local network connects to.
Test 3 — Test DNS Resolution
If you can successfully ping the default gateway of your Firebox, the next step is to test DNS resolution. To test DNS resolution, attempt to ping a remote web host, such as www.watchguard.com. If this fails, attempt to ping a remote IP address, such as the DNS server for your ISP, or a public DNS server such as 8.8.8.8 or 4.2.2.2. If you can successfully ping a remote IP address, but cannot ping a host name, that indicates a problem with DNS resolution.
If DNS resolution fails, investigate these possible causes:
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
Use the Windows command line on your client computer to test DNS resolution. If you do not specify the IP address of a DNS server, the nslookup command uses the default DNS server.
First, test DNS with the default DNS server:
nslookup www.watchguard.com
Next, add the IP address to a public DNS server:
nslookup www.watchguard.com 8.8.8.8
If DNS resolution does not work with the default DNS server but works with the public DNS server, check the DNS servers used by the client computer and the Firebox.
- To see the default DNS server used on the client computer, use the ipconfig/all command on the Windows command line. The DNS server on the client should usually be the same as the DNS server used by the Firebox.
- To see the current DNS server IP addresses for the Firebox in Fireware Web UI, select Dashboard > Interfaces > Detail. To see the DNS servers in Firebox System Manager, expand the Interfaces status for the Firebox in the Front Panel tab.
To verify whether traffic can be routed to a DNS server, and whether a DNS server is responding you can try to ping the DNS server IP address from the client computer, and from the Firebox.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
If you can successfully ping the DNS server from a client computer on your network, DNS resolution fails if the Firebox configuration does not have a policy that allows outgoing DNS requests.
To further troubleshoot this, you can test DNS resolution from the Firebox as described above to see if DNS resolution works from the Firebox. If DNS resolution works from the Firebox, but does not work from clients on the internal network, it is likely that there is no policy on the Firebox to allow outbound DNS requests. To see if this is the case, examine the log messages in Traffic Monitor while you test DNS or attempt to resolve external host names. Look for log messages for denied connections with a destination port of 53.
If you disable or delete the default Outgoing policy, the Firebox does not allow outbound DNS requests unless you add another policy to allow these connections. If you delete the Outgoing policy, make sure that your other policies allow hosts on your network, or at least key servers, to connect outbound for DNS, NTP and other necessary functions.
For more information about the Outgoing policy, see About the Outgoing Policy.