topic Can Loopback be Used as a VPN Source on VSX? in Firewall and Security Management

Can Loopback be Used as a VPN Source on VSX?

manny799 — Fri, 11 Mar 2022 15:46:34 GMT

Hi there,

We have a VSX cluster currently running on version R80.30. We have a requirement to migrate the external IP range to a new subnet (within a different part of the same larger IP address block so we have full control over routing within that block etc). However, we have multiple VPNs terminating on some of the virtual firewalls. I notice that in R81.10, Loopback interfaces are supported on VSX for Dynamic Routing over VPNs, however does anybody know if these could be used (and it is a supported configuration) as the source interface of a standard policy based site to site VPN? (Obviously we would need to add /32 routes externally for the old external address that was then migrated to the loopback).

Thanks,

John M

Re: Can Loopback be Used as a VPN Source on VSX?

the_rock — Fri, 11 Mar 2022 18:43:38 GMT

Wow, thats super interesting question...I would be curious to know as well. Personally, I never heard of something like that being supported.

Re: Can Loopback be Used as a VPN Source on VSX?

Chris_Atkinson — Sat, 12 Mar 2022 02:12:54 GMT

I've seen dummy DMZ interfaces used for similar in the past, but not tested this approach as yet myself.

Suggest requesting a formal answer via TAC or your SE.

Re: Can Loopback be Used as a VPN Source on VSX?

PhoneBoy — Sun, 13 Mar 2022 13:38:25 GMT

What matters is the IP address you configure for Link Selection, which I assume could be that loopback address.