LAB 28 ::‐ Allowing ICMP in Security list within same subnet (Self ‐Rule) and validate via PING utility. - guptasanjeev-52/oci_docs GitHub Wiki

firstly , Creating Two instancs in OCI...Then connecting step by step the instance in a putty and run below Command...

Step by step...

Burger menu >>> Networking >>> Virtual cloud networks >>> VCN (hub-vcn) >>> Security.

Default Given by OCI

Security Rules..

Main thing For (Connecting we always need PRIVATE IP) // (Login we always need PUBLIC IP)...

So, Connect the Private IP to the putty server...

Take it to the Root Level and then Run The Below Command to Know the Both Host IP's..

1st Instance...

hostname -i

2nd Instance...

hostname -i

Now, Try to ping one instance to another instance in the same subnet...

ping (host IP)

Run the PING Command from bastion_server1 to amazon_server. The packet Reaches the server but it is Dropped by the Ingress rule...

So, the PING Fails...

Now we will Run the PING Command from amazon_server to confirm that Communication is working. The reply is received because the firewall Tracks the Active connection....

Enable Stateless in default Egress Rules for ICMP

When we enable stateless in default egress rules then we will see that even if we run ping in both terminal we will not see ping working.

To enable Stateless click on actions menu of particular egress rule and click edit then enable Stateless and click Save changes..

Testing in putty...Now ping again first run in bastion_server1 it fails

Second Try to ping in amazon_server which also fails because we fixed the loophole by enabling stateless

Enable Stateless Ingress & Stateless Egress Rules for ICMP...

Deleting Egress Rule and ICMP Ingress rule and checking the Ping command

First lets remove all ingress and egress rules associated with ICMP to make the interface clean (but don't touch the default TCP ingress rule)

Copying the CIDR from the public subnet

INGRESS RULE

EGRESS RULE

Now lets ping again first run in bastion_server1 it works...

Now try ping in amazon_server which also works...

Enable Stateful Ingress & Stateful Egress Rules for ICMP

In Both the Rule just Disable the Stateless...