Troubleshoot Network Connectivity

To test and troubleshoot your network, you can use tools available on your client computer and on your Firebox. For the tests that involve commands issued from a Windows client computer, use a computer on a trusted, optional, or custom network connected to the Firebox.

Network Troubleshooting Tools

Use these tools and methods to test network connectivity and host name resolution on your network. These test methods are referenced in the troubleshooting steps in the next sections.

Troubleshoot Outbound Connections

To identify the cause of Internet connection problems from computers on your local network, start with ping tests from a local computer on your network to the Firebox or a local server on your network. If that is successful, the next step is to test routing and DNS resolution to hosts outside your local network. Use the instructions in the previous section to run the diagnostic commands used in these tests and to look at log messages.

Test 1 — Ping an Internal IP Address

From your local computer, try to ping other internal IP addresses on the same local network. For example try to ping a local network server, or the IP address of a Firebox internal interface. To start a ping from a Windows computer, use the instructions in the preceding section.

If you are cannot ping the internal IP address of the Firebox, this could indicate a problem with the configuration on the Firebox, or a problem with your local network configuration or cabling. To view the IP address and default gateway in local network configuration on a client computer, from the Windows command prompt, use the ipconfig command.

Look at the ipconfig command output and consider these possible causes for the ping failure:

Test 2 — Ping the Default Gateway of the Firebox

If you can successfully ping the IP address of the Firebox interface, test whether traffic from the client computer can be routed to addresses outside the Firebox. To test this, from your Windows computer try to ping the default gateway for the Firebox external interface. This confirms that your computer can route to a host outside the Firebox, and that your Firebox is configured to allow these ping requests.

You can view the IP address of the Firebox external default gateway in WatchGuard System Manager, or in the Interfaces dashboard in Fireware Web UI.

If your network has an Internet gateway other than the Firebox, Internet-bound traffic from clients on your network might not be routed through the Firebox. To verify that outbound traffic to the Internet goes through the Firebox, enable logging of allowed packets in the ping policy and verify that log messages are created for ping requests from your network. For details about how to do this, go to the preceding Network Troubleshooting Tools section.

If your ping to the default gateway of the Firebox external interface fails, verify these possible causes:

Test 3 — Test DNS Resolution

If you can successfully ping the default gateway of your Firebox, the next step is to test DNS resolution. To test DNS resolution, try to ping a remote web host, such as If this fails, try to ping a remote IP address, such as the DNS server for your ISP, or a public DNS server such as or If you can successfully ping a remote IP address, but cannot ping a host name, that indicates a problem with DNS resolution.

If DNS resolution fails, investigate these possible causes:

Troubleshoot Traffic Flooding

Traffic flooding occurs when the Firebox receives a high volume of traffic and it cannot examine and then allow permitted network traffic. This can cause traffic or Internet connectivity to fail. To address traffic flooding, the Firebox drops connections that exceed the values that you specify in the Default Packet Handling settings. For more information, go to About Default Packet Handling Options.

If you experience traffic flooding and dropped packets, you can:

  1. Specify the relevant logging and notification settings by dangerous activity type (Fireware Web UI v12.8 and higher). Make sure that you enable logging for each type of dangerous activity. By default, the Firebox sends a log message when an event occurs that matches the default packet handling settings. If you want more log message data to analyze, you can increase the log message rate. For more information, go to the Dangerous Activity Logging and Notification Settings section of About Default Packet Handling Options.

  2. Use Traffic Monitor to view the Firebox log messages and identify which default packet handling setting caused the Firebox to drop connections.
    In this example, UDP flooding caused the Firebox to drop connections:

    2023-03-29 10:55:22 Member2 Deny 8211/udp 8211 8211 130-NPS-AP 3002-CO-WAN udp flooding 582 64 (Internal Policy) proc_id="firewall" rc="101" msg_id="3000-0148" Traffic

  3. Use the generated log messages to determine the acceptable number of packets per second received threshold for your network. Based on the presence of these log messages, you can increase the threshold and then verify if the log messages continue. For more information, go to About Flood Attacks.

  4. (Optional) You can download log message data and other system information from your Firebox in a diagnostic log message file (support.tgz) that you can send to your Support representative. However, for the diagnostic log message file to contain relevant information, you must capture the information while the flood takes place or immediately after. For more information, go to Download a Diagnostic Log Message File in Fireware Web UI.

Related Topics

Routes and Routing

About Multi-WAN