topic Re: How to overcome on directly connected route in Firewall and Security Management

How to overcome on directly connected route

Semi_Ara — Tue, 20 Mar 2018 13:09:15 GMT

Hi,

I have an appliance with version R80.10 and jumbo fix 70.

There is a VPN tunnel with VTI to another site and there is a network (1.1.1.0/24) behind the gateway which also exist on the other site.

I would like to route the traffic to 1.1.1.0/24 network trough the VTI to the remote site and in case the VPN fails the directly connected route will take place.

I tried to configure static routes, policy base routes, etc. on the appliance, but the directly connected route will always override the other routes.

Did someone do something like that?

Thanks

Re: How to overcome on directly connected route

PhoneBoy — Tue, 20 Mar 2018 16:32:44 GMT

Interface routes are kernel routes, which have a priority of zero.

They will always have priority over routes configured statically or with dynamic routing protocols.

Re: How to overcome on directly connected route

Semi_Ara — Wed, 21 Mar 2018 12:33:20 GMT

There is way to change the protocol rank value, but it does not allow to change for kernel routes. Is there a particular reason why? How other vendors do that?

Re: How to overcome on directly connected route

PhoneBoy — Wed, 21 Mar 2018 14:58:05 GMT

I can't speak for how other vendors do it.

That said, there are always going to be issues when you have address space both locally and on the other end of the VPN.

Adding an extra hop between the local version of 1.1.1.0/24 and your gateway will make this a lot easier to resolve.

Re: How to overcome on directly connected route

Semi_Ara — Wed, 21 Mar 2018 15:17:32 GMT

I will check if adding additional hop if possible.

thanks

Re: How to overcome on directly connected route

Maarten_Sjouw — Sun, 25 Mar 2018 12:08:54 GMT

The way to solve this is by setting up 2 more specific routes, one for 1.1.1.0/25 and one for 1.1.1.128/25