topic Re: Funny IP on show configuration in Firewall and Security Management

Funny IP on show configuration

Enyi_Ajoku — Thu, 04 Jun 2020 20:51:50 GMT

Hi,

i'm trying to export "show configuration" from one of my Virtual System to a third party device for auditing purposes and i noticed that it shows the funny IP as show below:

set interface bond1.100 state on
set interface bond1.100 mtu 1500
set interface bond1.100 ipv4-address 192.168.196.49 mask-length 28
set interface bond1.101 state on
set interface bond1.101 mtu 1500
set interface bond1.101 ipv4-address 192.168.196.65 mask-length 28

Is this how it should be or i'm i missing something. Ironically, doing ifconfig shows the actual IP associated with each bond as well as on the Management Station.

Thank You

Re: Funny IP on show configuration

PhoneBoy — Mon, 08 Jun 2020 02:52:22 GMT

What precise version is this?

Re: Funny IP on show configuration

Enyi_Ajoku — Mon, 08 Jun 2020 13:11:35 GMT

R80.30 and R80.10

Re: Funny IP on show configuration

Maarten_Sjouw — Mon, 08 Jun 2020 17:16:02 GMT

Is it by any chance a VSX System?

Re: Funny IP on show configuration

Wolfgang — Mon, 08 Jun 2020 18:53:08 GMT

@Enyi_Ajoku you wrote "my Virtual System".

As @Maarten_Sjouw indicates, looks like a VSX system.

192.168.196.0/255.255.252.0 is the default subnet for VSX internal network. Every virtual system has an IP in this subnet.

You can see this on the VSX object.

Wolfgang

Re: Funny IP on show configuration

Enyi_Ajoku — Mon, 08 Jun 2020 21:50:28 GMT

Yes it is

Re: Funny IP on show configuration

Enyi_Ajoku — Mon, 08 Jun 2020 21:56:11 GMT

I am aware of the internal IP address on VSX system but what i am referring to is an ip associated with a bond that is configured on Management Station on VSX.

ifconfig shows actual ip associated with bond, same as on the management station but when i do show configuration on for example vs1 is shows funny ip as i have stated in the configuration snippet above

Re: Funny IP on show configuration

Maarten_Sjouw — Tue, 09 Jun 2020 06:38:00 GMT

That is still one of the problems with VSX, ifconfig only shows the real IP's since R80, before it also showed the 192.168.x addresses.
So there is at least 1 point to find the real IP's.
To be honest, on a VSX box I rarely connect in clish, as there is very little you can/need to do there.

Re: Funny IP on show configuration

genisis__ — Sun, 23 Jan 2022 18:54:11 GMT

In my R80.40 VSX setup I see the external IPs not the internal (funny) ones. I've not see this since pre-R77 VSX, and even then you could toggle this display to external IPs.

It makes allot of sense to display the external IPs i.e. IPs defined in the topology in Smartconsole purely from a track and troubleshooting prospective.

I've got a VSX R81 setup which has this problem and just logged a TAC case, which is purely a cosmetic issue, rather then functional.

Re: Funny IP on show configuration

oh_mhari — Mon, 20 Apr 2026 07:59:40 GMT

Hello @Enyi_Ajoku , No it should not be like this.

I had this issue too and this resolved the issue for me.

1. Set vsx on

2. Save config

3. Reboot cluster Member.

You should be mindful to do this during a maintenance window lol but if you do not mind rebooting that cluster member then you should be fine.

Check Point R&D is still looking into the issue as to why the member has to be rebooted before it takes effect.

Re: Funny IP on show configuration

Bob_Zimmerman — Mon, 20 Apr 2026 14:58:33 GMT

Technically, it's the other way around. The 192.168.196.0/22 block is the real addresses the interfaces actually have. 'ifconfig' by itself is an alias to /bin/cp-ifconfig.sh, which lies to you and shows the cluster VIPs instead of the real IP on the interfaces. You can see this by running the real ifconfig binary located at /usr/sbin/ifconfig.

This can be important to know, since the IPs you assign to virtual systems have all the same limitations and concerns as VIPs on a non-VSX cluster. They're claimed via the same mechanism, and you can use off-net VIPs with normal clusters, too.

VSNext in R82 changes this. On an ElasticXL cluster (and VSNext requires ElasticXL), all the members actually have the addresses on their interfaces, and they use virtual MACs to control which member gets traffic.