topic Re: Any downsides in using IPs from 127.0.0.0/8 for Local VTIs and the router-ID in a ClusterXL? in Firewall and Security Management

Any downsides in using IPs from 127.0.0.0/8 for Local VTIs and the router-ID in a ClusterXL?

Vladimir — Wed, 03 Mar 2021 05:10:20 GMT

In the process of setting up BGP over IPsec between ClusterXL & a number of peers.

I am aware that this question was brought-up multiple times, but there were no conviction in replies.

Can we have someone from Check Point ClusterXL and Advanced Routing to clarify if 127.0.0.0/8 addresses are suitable for use

in the ClusterXL as router-id or if we must chose one of the vIPs?

Additionally, Local VTIs require any arbitrary IPs, so unless there are reasons why this is a bad idea, I'd like to pick those from the same range.

Thank you for your help,

@Vladimir

Re: Any downsides in using IPs from 127.0.0.0/8 for Local VTIs and the router-ID in a ClusterXL?

Sundeep_Mudgal — Fri, 05 Mar 2021 22:51:12 GMT

You can pick any IP as router-id as long as it is same across all cluster nodes and unique in your environment. It does not have to be VIP. We have not done testing with 127.0.0.0/8 as router-id but is not blocked and is configurable so it should work. Please open a support ticket if you have any issues using any IP as a router-id.

Re: Any downsides in using IPs from 127.0.0.0/8 for Local VTIs and the router-ID in a ClusterXL?

Vladimir — Sat, 06 Mar 2021 00:30:33 GMT

Thank you, I'll give it a try.