topic Re: Route Propagation not working in virtual system in General Topics

Route Propagation not working in virtual system

an_technical — Sat, 14 Dec 2024 10:53:11 GMT

Hi All,

I have a setup with two virtual systems and internal and external virtual-switch

My two vsys has dedicated interface.

VSYS-1

Eth-6 -> 192.168.2.12/24

VSYS-2

Eth-7 - 192.168.3.12/24

I have enabled route propagation on both interfaces and these two vsys has connectivity with both internal and external vswitch.

But I am not able to see propagated routes in both vsys.

I am using R80.40 at the moment.

Please assist where the problem can be.

Thank You

Re: Route Propagation not working in virtual system

Chris_Atkinson — Sun, 15 Dec 2024 08:21:19 GMT

Which JHF take is installed on the system?

Are all routes you expect to be propagated not present or just some specific ones?

Refer also: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_VSX_AdminGuide/Content/Topics-VSXG/VSX-Routing-Concepts.htm

( Please note R80.40 is EOL and you should consider upgrading in the near term ).

Re: Route Propagation not working in virtual system

the_rock — Sat, 14 Dec 2024 13:52:14 GMT

I agree with Chris 100%. You should upgrade to officially supported version, which is at least R81.10 at the moment, but I would recommend R81.20 if possible.

Andy

Re: Route Propagation not working in virtual system

an_technical — Sun, 15 Dec 2024 06:50:14 GMT

I have 211 hotfix installed on both management and VSX gateway.

I attached the screenshot of topology of both VSX.

I don't see 192.168.2.0/24 and 192.168.3.0/24 in both VSX routing table

Re: Route Propagation not working in virtual system

Chris_Atkinson — Sun, 15 Dec 2024 14:26:00 GMT

Has each gateway had its policy installed recently, how long has each been up?

Can we please also see the following output from each VS.... the topology seems not correct.

netstat -rn

ip route get x.y.z.0

Re: Route Propagation not working in virtual system

Wolfgang — Sun, 15 Dec 2024 17:42:43 GMT

@an_technical I believe your topology is a little bit wrong. You have a layer 2 connect between both VS via 2 virtual switches. That‘s ok, but all attached interfaces are on different IP subnets, so no routing is possible between VS1 and VS2 and vice versa. And additional you have always two connects between both VSs, this must be observed with priorities.

I believe you‘re talking only about route propagation via the route configuration settings in the VS object not any other dynamic routing protocol like OSPF or BGP …?

Re: Route Propagation not working in virtual system

the_rock — Sun, 15 Dec 2024 18:20:59 GMT

Im not vsx guru by any means, but purely from routing perspective, makes total sense.

Andy

Re: Route Propagation not working in virtual system

an_technical — Mon, 16 Dec 2024 03:50:30 GMT

Thanks @Wolfgang : Yes you are right. I corrected the interface IP on wrp interface and I see route is propagated now. I am propagating the internal segment routes but these are propagated through external vswitch.

I am not able to find anything where we can propagate these through internal switch. Any suggestions pleas?

@Chris_Atkinson @the_rock

Re: Route Propagation not working in virtual system

the_rock — Mon, 16 Dec 2024 03:56:02 GMT

No option to do it via topology?

Andy

Re: Route Propagation not working in virtual system

an_technical — Mon, 16 Dec 2024 04:22:19 GMT

I can add manual static routes by disabling route propagation but we have large number of routes.

Re: Route Propagation not working in virtual system

Chris_Atkinson — Mon, 16 Dec 2024 07:44:16 GMT

Note sure if it behaves differently in newer supported versions without testing, refer also:

https://community.checkpoint.com/t5/Security-Gateways/VSX-route-propagation-with-more-then-one-vSwitch/m-p/55193

Re: Route Propagation not working in virtual system

Wolfgang — Mon, 16 Dec 2024 13:43:49 GMT

@an_technical you have a redundant connection between both VS, with VSX route propagation there is no way to differentiate an prioritize. You can remove one of the vswitches or you have to define the routes manually.

With vsx_provisioning_tool you can define a large range of routes via script.

Re: Route Propagation not working in virtual system

an_technical — Mon, 16 Dec 2024 13:48:33 GMT

Is there any known issue on R81.20 Version 631?

Re: Route Propagation not working in virtual system

Chris_Atkinson — Mon, 03 Feb 2025 11:40:31 GMT

Not to my knowledge. Which JHF?