topic Re: Disable IP-advertisement for a VS in Firewall and Security Management

Disable IP-advertisement for a VS

maad-pul — Thu, 11 May 2023 19:51:03 GMT

I would like to disable IP-adertisement for a VS within my VSX-cluster for some VLAN and Virtual Switch interfaces (warp). VS will be moved to a VMware CloudGuard solution and I will reuse IP-addresses and VLAN in the new infrastructure.

I can’t find any disable option for interfaces in SmartConsole for VS within VSX-cluster?

Will cpstop for a specific VS stop advertisement for all interfaces for that VS?

Do you have any suggestions for a smooth migration with reuse of IP-addresses?

Regards

Mattias

Re: Disable IP-advertisement for a VS

PhoneBoy — Mon, 15 May 2023 17:02:38 GMT

Not sure what you mean by "disable IP advertisement" can you elaborate?

Re: Disable IP-advertisement for a VS

maad-pul — Mon, 15 May 2023 17:08:05 GMT

I need to get IP-addresses disabled for the VS vlan-interfaces so I don’t get any IP-conflicts when migrating to new environment.

Re: Disable IP-advertisement for a VS

the_rock — Mon, 15 May 2023 17:21:49 GMT

I dont believe cpstop would take care of that, as it would simply remove active policy, not any IP schema. Personally, I never heard of such a command, not sure if it exists, but lets see if someone else know if there is a way.

Re: Disable IP-advertisement for a VS

Wolfgang — Mon, 15 May 2023 17:44:53 GMT

@maad-pul you can change the ip-addresses or as another option change the VLAN IDs to something currently not in used in your VSX environment.

Re: Disable IP-advertisement for a VS

maad-pul — Mon, 15 May 2023 17:58:33 GMT

I dont think cpstop will work either, even if that was a solution informed by TAC. Change IP-addresses seems like the only solution which is 100% sure for now, some VLANs are used by other VS (via vswitch) so they cant be change in the VSX.

Re: Disable IP-advertisement for a VS

the_rock — Mon, 15 May 2023 18:00:56 GMT

You can tell them to test it in their lab and they will see the result. So, what you mentioned appears to be most logical way

Andy

Re: Disable IP-advertisement for a VS

Wolfgang — Mon, 15 May 2023 19:19:55 GMT

You can create new virtual switches with different VLAN-IDs and use the newly created virtual switches for your interfaces instead of the one in production.