topic Re: pep: inx invalid type in General Topics

pep: inx invalid type

Bill_Ng — Fri, 28 Dec 2018 13:51:43 GMT

Hi All,

Since we have upgraded from R77.30 to R80.10 Take 156 on a VSX gateway and regular gateway, I am seeing 'inx invalid type (0) on the VS instances on the appliances.

When I run 'pep show pdp all' the Source IP isn't listed. See below.

When I run 'pep show pdp all' on R80.10 Take 121 on a gateway. I get the info I expect.

I ran a packet capture on R80.10 Take 121 appliance using 'tcpdump -enni any port 15105' I noticed that the IPs were different between the pep show pdp all command and the packet capture.

10.1.1.1 was shown in 'pdp show pdp all' which is the management IP of the pdp cluster.

10.2.2.2 was shown in the packet capture which is the inside/campus interface of the same pdp cluster.

I also looked at sk60701. Nothing is set in ia_control_connections_ip field.

Questions are below.

Any reason for why we see inx invalid type (0)?
Is there concern that 2 different IPs are being reflected? And could that be causing a problem?

We are using Identity agent client using user authentication installed our workstations.

Thanks,

Bill

Re: pep: inx invalid type

Frank_Allen — Fri, 28 Dec 2018 14:08:13 GMT

Hey Bill,

Since you and I have a service request on this, I will be able to provide you more details on this as we investigate this with our R&D team. We aren't sure of the full impact regarding "inx invalid type (0)", but this signifies that the IP has changed somewhere between PDP and PEP in their communications, which could cause some syncing issues.

I will update you in our Service Request regarding this issue as soon as I have more information.

Thanks,

Frank

Re: pep: inx invalid type

Tobias_Moritz — Mon, 11 Feb 2019 17:41:24 GMT

We have the same problem in one of our platforms.

Identity Sharing is working fine between R77.30 PDP and R80.10 PEP Jumbo HFA T121. Any newer Jumbo HFA on the R80.10 PEP side and we have the same problem like you:

"inx invalid type (0)" instead of the PDP source IP.

We have set an ia_control_connections_ip like descriped in sk60701, so it has obviously nothing to do with this.

We are already in contact with TAC (case 6-0000617243) and they asked R&D already.

But no solution yet.

Re: pep: inx invalid type

Bill_Ng — Mon, 11 Feb 2019 18:09:29 GMT

Hi Tobias,

We ended up changing the setting under the setting under Identity Sharing for the FW from 'all sharing gateways' to the defined pdp server. I also recall that if you did a 'pep debug ip_map' when having the issue it displayed something odd as well or coincided with inx invalid type you are seeing. Once we pointed the FWs to the main pdp gateway, it all looked much better.

Thanks,

Bill

Re: pep: inx invalid type

Tobias_Moritz — Mon, 11 Feb 2019 18:22:53 GMT

Thanks for the hint, but we checked this already. We never used the „all sharing gateways“ option, but set one specific main pdp gateway only.

We also cleaned all IDA tables with the fw tab command. It didn‘t help.

Re: pep: inx invalid type

Tobias_Moritz — Mon, 18 Mar 2019 08:58:21 GMT

Sorry, I forgot to update here:

The solution for our problem was sk63264 (manual nat rule required to hide pdp<->pep traffic behind cluster address).

This sk is very old, so it's a little strange that we never needed this with R77.x or R80.10 older jumbos.