topic Re: Blackhole static routes in VSX in General Topics

Blackhole static routes in VSX

Usman_Shaikh — Thu, 20 Sep 2018 10:01:41 GMT

I am trying to advertise a non-connected network on the checkpoint virtual system in OSPF. Usually we would just add a blackhole/null0 static route and redistribure that in OSPF but I cannot find a way to add this type of static route in VSX

Can you point me in the right direction please or if there is a better way to advertise this in OSPF

Also how do I go about configuring a loopback interface in VSX ?

Many thanks

Re: Blackhole static routes in VSX

PhoneBoy — Sat, 22 Sep 2018 22:33:15 GMT

From clish, you should be able to add a loopback interface: add interface lo loopback <IP Address>/<Mask>

Re: Blackhole static routes in VSX

Usman_Shaikh — Sun, 23 Sep 2018 08:36:51 GMT

Many Thanks Dameon; however the command is not available in clish (note this is VSX gateway)

fw1> add interface lo loopback 10.1.1.1 255.255.255.255
CLINFR0329 Invalid command:'add interface lo loopback 10.1.1.1 255.255.255.255'

fw1> add
aaa              - Authentication authorization and accounting
allowed-client   - Add allowed client
arp              - Add ARP entries
backup           - Start a backup of the system
backup-scheduled - Determine the type of scheduled-backup of the system
bonding          - Configure bonding interfaces
cloning-group    - Configure Gaia Cloning Group
command          - Add extended command.
cron             - Add new scheduling for a command
dhcp             - Configure or view DHCP settings.
group            - Specify group name
host             - Static host configuration
netflow          - NetFlow export of traffic information
rba              - Role-based administration configuration
snapshot         - Take snapshot
snmp             - Simple Network Management Protocol Information
syslog           - System log configuration
upgrade          - Upgrade of Check Point OS and Products
user             - A user name
vpn              - vpn configuration

Any ideas for VSX ?

Also what about the blackhole route piece ?

Re: Blackhole static routes in VSX

Vladimir — Sun, 23 Sep 2018 14:17:47 GMT

Have you tried adding the loopback to the VSX itself and then choosing it from the VS context?

Re: Blackhole static routes in VSX

Usman_Shaikh — Tue, 13 Nov 2018 17:07:14 GMT

Sorry for the late response.. but i have tried to add it via VS0 but unable to do so..

vsxgw1:TACP-15:0> add interface lo loopback 10.1.1.1/32
CLINFR0699 Invalid command.

Any more ideas ?

Re: Blackhole static routes in VSX

Vladimir — Tue, 13 Nov 2018 18:49:37 GMT

I believe that you supposed to perform "set vsx off" before adding new interface and "set vsx on" once it is done.

Re: Blackhole static routes in VSX

RKinsp — Tue, 19 Jan 2021 00:23:50 GMT

Hello Usman,

Did you ever get this to work? I am trying the same thing but in a cluster. With set vsx off I can actually create the interface, but I have to set and IP and it shows up in all the VSs (not in SmartConsole thought). Thanks, RK

Re: Blackhole static routes in VSX

Freco_Wong — Mon, 22 Mar 2021 03:02:35 GMT

I need this too... in VSX mode, is there any updates?

Re: Blackhole static routes in VSX

SimonDrapeau — Fri, 09 Jul 2021 17:02:16 GMT

Using a loopback interface with Dynamic Routing in ClusterXL environments (including VSX) is supported starting with Check Point R81.10.

Check Point R81.10 was released (July 6, 2021). For more information, see sk170416.

sk117794 has been updated accordingly.

Simon