topic Re: VTI Numbered to Unnumbered Peer Interop in Firewall and Security Management

VTI Numbered to Unnumbered Peer Interop

stallwoodj — Thu, 16 Nov 2023 14:25:46 GMT

Hi,

I'm in the process of investigating a conversion from non-CP firewall to VSX virtual firewall.

The current device has lots of unnumbered (route-based) tunnels to third parties with various different vendor firewalls. VSX requires VTI's to have IP addresses.

A quick test between my lab VSX and a standalone CP with an unnumbered VTI (statements such as "set static-route 192.0.2.1/32 nexthop gateway logical vpnt9 on") seems on cursory testing to work.

Has anyone else used numbered VTI's interoperating with remote unnumbered tunnels, is it supported and are there any caveats please?

Thanks!

Jamie

Re: VTI Numbered to Unnumbered Peer Interop

PhoneBoy — Mon, 20 Nov 2023 16:17:10 GMT

I've never heard of any issues one way or another.

Re: VTI Numbered to Unnumbered Peer Interop

Bob_Zimmerman — Mon, 20 Nov 2023 19:19:05 GMT

The numbering of VTIs is only locally-significant. Numbered and unnumbered work just fine for passing traffic. You won't be able to talk firewall-to-firewall (since one of the firewalls won't recognize the traffic as being for itself), but that's generally only used for dynamic routing over the VTI.

Re: VTI Numbered to Unnumbered Peer Interop

the_rock — Mon, 20 Nov 2023 19:23:39 GMT

I seen customers do that before and it does work. Not sure if its officially supported, but works fine.

Andy