Has anyone run into issues using dynamic routing and VTIs post R80.10?
Last weekend I upgraded a customer firewall which was specifically used to terminate route based VPNs on.
6 VTIs configured, 4 numbered (2 for AWS, 2 for Azure), 2 unnumbered (other stuff).
Post R80.40 upgrade the unnumbered tuinnels came up fine, but both the AWS and Azure ones did not. I could see outbound tunnels established, but nothing inbound, all of these tunnels are additionally using BGP.
Disabled SecureXL acceleration with "fwaccel off" and they leapt into life, again, enabling SecureXL and then disabling vpn acceleration with "vpn accel off" also allowed traffic to flow.
Now there may be some other issues going on, in that further examination showed that some of the BGP config was mismatched on the cluster, but I don't think it was this, as when I rolled the R80.40 member back to R80.10 it all worked again.
I have arranged a new window next weekend to re-attempt, but has anyone else run across anything like this? It feels a weird coincidence that the VTI tunnels using dynamic routing don't work with acceleration, but the others do.
I'm also getting the feeling that ISP redundancy may be a bit iffy under R80.40 as well, as again I have another customer where it doesn't work correctly with acceleration turned on.