Secondary gateway / Route not working

[Deepak Kumar]

Hi Everyone,
I am facing an issue with a route. I am using OPNsense firewall in Bridge mode. My Internal Network (behind the l3 Core Sw) is on 10.10.10.0/24 series and my ISP router to L3 Switch Uplink (Firewall is between of both) are on 10.10.11.0/24 series.
I have added a default route toward to WAN, is working fine. But I have added a static route toward to my L3 Switch and Internal LAN is not working fine.

Firewall routing table is:

root@FO-FIREWALL:~ # netstat -r
Routing tables

Internet:
Destination        Gateway            Flags     Netif Expire
default            10.10.11.1         UGS     bridge0
google-public-dns- 10.10.11.1         UGHS    bridge0

10.10.10.0/24      10.10.11.3         UGS     bridge0

10.10.10.21        10.10.11.3         UGHS    bridge0
10.10.11.0/24      link#7             U       bridge0

10.10.11.2         link#7             UHS         lo0

10.10.11.3         02:14:a0:a5:14:00  UHS     bridge0
localhost          link#4             UH          lo0


When I am trying to my 10.10.10.0 series system then getting the following error:

root@FO-FIREWALL:~ # ping 10.10.10.1
PING 10.10.10.1 (10.10.10.1): 56 data bytes
36 bytes from 10.10.11.1: Redirect Host(New addr: 10.10.11.3)
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 0054 607e   0 0000  3f  01 f214 10.10.11.2  10.10.10.1

36 bytes from 10.10.11.1: Time to live exceeded
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 0054 607e   0 0000  01  01 3015 10.10.11.2  10.10.10.1

36 bytes from 10.10.11.1: Redirect Host(New addr: 10.10.11.3)
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 0054 3da3   0 0000  3f  01 14f0 10.10.11.2  10.10.10.1

36 bytes from 10.10.11.1: Time to live exceeded
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 0054 3da3   0 0000  01  01 52f0 10.10.11.2  10.10.10.1

Please help to troubleshoot the issue.

Thanks,
Deepak Kumar

[Deepak Kumar]

Its resolved after configuring the Floating rules in the firewall.

Regards,
Deepak Kumar