topic Re: Loopback interface is going out of routing table in Firewall and Security Management

Loopback interface is going out of routing table

Gombodorj — Thu, 09 Feb 2023 07:00:58 GMT

I have Quantum 6700 appliances running as VSX cluster and I have configured loopback interface with an IPv4 address.

This works perfectly for like 1-2 days. Then suddenly this IPv4 address drops out of the FW's routing table and no longer works.

When I run "show interfaces all" it shows the loop00 interface correctly with the IP address. But there is nothing regarding this IP in the routing table after 1-2 days.

Why is it dissappearing from routing table after some hours?

Re: Loopback interface is going out of routing table

Chris_Atkinson — Mon, 13 Feb 2023 01:17:19 GMT

Which version and JHF is used for this VSX gateway - R81.10 JHF Take ?

Refer also:

[sk117794] OSPF configured on a loopback interface is not added to OSPF database in Cluster on Gaia OS

[sk108848] Output of "cphaprob -a if" command shows a Loopback interface as "Down" on all cluster members

Re: Loopback interface is going out of routing table

Gombodorj — Thu, 09 Feb 2023 08:12:27 GMT

I'm using R81.10 JHF Take 79 on the VSX gateway. The way I do it is as follows:

1. set vsx off
2. add interface lo loopback X.X.X.X/32
3. set vsx on
4. save config

As I said before after this IP address drops out of routing table. I have to do the above configuration again to make it come up.

Re: Loopback interface is going out of routing table

Chris_Atkinson — Thu, 09 Feb 2023 08:33:23 GMT

This method of adding interfaces in VSX isn't supported per responses to your previous post on a similar topic.

To be clear the loopback is present/defined in the Virtual System topology in SmartConsole?

Re: Loopback interface is going out of routing table

Gombodorj — Thu, 09 Feb 2023 08:19:36 GMT

I thought that you can't use loopback interface (aside from lo 127.0.0.1) on smartconsole. On the topology pane of the gateway object, if I try to like define loop00 interface with IP address, it shows error.

Can you explain about how can I check it?

Re: Loopback interface is going out of routing table

Chris_Atkinson — Thu, 09 Feb 2023 08:33:46 GMT

R81.10 introduced:

Use a loopback interface with Dynamic Routing in ClusterXL environments.

This mandates that the Loopbacks are defined in the Gateway topology, I assume the same is true also for VSX Virtual Systems but will check and revert that this is also supported or not.

Re: Loopback interface is going out of routing table

Gombodorj — Thu, 09 Feb 2023 08:33:08 GMT

I'm using this method on the VSX gateway itself, I also just tried making a interface named loop00 on the topology pane. It shows illegal error.

Is there a mechanism like looks up the topology and uses this information for the routing table? If so I suspect that whatever that mechanism is invalidating my loopback interface C route because it doesn't exist in the topology. How can I define loopback interface in smartconsole?

Re: Loopback interface is going out of routing table

Chris_Atkinson — Thu, 09 Feb 2023 08:40:04 GMT

As above I will confirm pending confirmation that it is supported the same as it is on a regular cluster.

Re: Loopback interface is going out of routing table

CheckPointerXL — Thu, 09 Feb 2023 17:46:10 GMT

Hey Chris, also for cluster, solution provided by sk117794 (linked from sk95968 @ point 4) ) seems to be very dangerous.

Like i said inside SR 6-0003534450, any new get interface with/without topology will invalidate/delete the manually created loopback interface. The behaivoir is confirmed and no solution provided (it works by design).

so, if you add new interface/vlan and you forgot to add loopback interface again, i suppose OSPF/BGP process will be disrupted because of new Router-ID needs to be selected

I've opened a RFE number hT5Nxy49E

Re: Loopback interface is going out of routing table

Chris_Atkinson — Tue, 14 Feb 2023 12:42:30 GMT

Confirmed: Loopback interfaces are not currently supported with VSX up to and including R81.20, sk79700 has been updated accordingly.

Depending on the specific requirement there are possibly other work arounds available (Dummy DMZ interface or VLAN etc).

This is otherwise an RFE that you should discuss with your local SE if critical.

Re: Loopback interface is going out of routing table

Chris_Atkinson — Mon, 07 Jul 2025 10:51:35 GMT

In the current day there are now additional options available depending on the use case:

VSNext (R82 and higher)
NAT Pools