topic Re: VPN Routes not visible in Gaia in Firewall and Security Management

VPN Routes not visible in Gaia

D_W — Tue, 15 Feb 2022 20:37:52 GMT

Hello Mates,

have here a R81.10 T22 with a S2S VPN to 3rd Party but I cannot see the route to the target encryption domain in the route table of the OS or in Gaia. The VPN works fine though.

Is this by design or do I miss an option?

Regards

David

Re: VPN Routes not visible in Gaia

mk1 — Wed, 16 Feb 2022 08:40:29 GMT

Is this a route based or policy based VPN?

Re: VPN Routes not visible in Gaia

D_W — Wed, 16 Feb 2022 11:15:12 GMT

We define in the VPN communities the encryption domains for each site so i guess it's domain based.
I haven't found a quick answer about the difference of each types (route based, policy based, domain based) 😅

Re: VPN Routes not visible in Gaia

mk1 — Wed, 16 Feb 2022 12:38:09 GMT

Then you will not find them in the routing table. You can try with the following command in the Expert mode:

fw tab -f -t vpn_routing -u

Re: VPN Routes not visible in Gaia

D_W — Wed, 16 Feb 2022 12:59:19 GMT

ah yes there i see it...
Any ideas how i can use this route now to redistribute it via OSPF?
I mean it works when I manually add an static-route for the neeeded route and add it to a route-map but this is an equal ugly solution as the output from "fw tab -f -t vpn_routing -u" 😥

Re: VPN Routes not visible in Gaia

mk1 — Wed, 16 Feb 2022 13:18:39 GMT

In my opinion, after you need dynamic routing the best way would be to convert to route based VPNs. As you said, it's not possible to advertise a route which doesn't exist in your routing table. The other option is the proposed from you, to add static route pointing to your gateway through the proper outgoing interface for instance and then advertise it via OSPF.

Re: VPN Routes not visible in Gaia

_Val_ — Wed, 16 Feb 2022 13:30:58 GMT

Those are not OS system level routes, those are VPN routes.

Re: VPN Routes not visible in Gaia

D_W — Wed, 16 Feb 2022 14:22:20 GMT

I checked now the situation on another CP Gateway (r80.40) where we have other domain based VPNs and there I see the kernel Routes. BUT only the routes from the star communities.

Tried now to reconfigure my Mesh-Community to Star to check if the Routes will show up but no 😞

Re: VPN Routes not visible in Gaia

Timothy_Hall — Wed, 16 Feb 2022 14:24:14 GMT

You can't redistribute that directly since routes in the vpn_routing table are not "real" routes that exist in the Gaia OS that OSPF can see.

If you are using at least R81, check out NAT Pools which should allow redistribution. Here is the relevant page from my Gaia 3.10 Immersion self-guided video series:

Re: VPN Routes not visible in Gaia

D_W — Fri, 18 Feb 2022 10:30:05 GMT

Cool! Thanks I can work with that handy solution!