Route Propagation not working in virtual system

[an_technical]

Hi All,

I have a setup with two virtual systems and internal and external virtual-switch

My two vsys has dedicated interface.

VSYS-1 

Eth-6 -> 192.168.2.12/24

VSYS-2

Eth-7 - 192.168.3.12/24

I have enabled route propagation on both interfaces and these two vsys has connectivity with both internal and external vswitch.

But I am not able to see propagated routes in both vsys.

I am using R80.40 at the moment.

Please assist where the problem can be.

Thank You

[Chris_Atkinson]

Which JHF take is installed on the system?

Are all routes you expect to be propagated not present or just some specific ones?

Refer also: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_VSX_AdminGuide/Content/Topic...

( Please note R80.40 is EOL and you should consider upgrading in the near term ).

[an_technical]

I have 211 hotfix installed on both management and VSX gateway.

I attached the screenshot of topology of both VSX.

I don't see 192.168.2.0/24 and 192.168.3.0/24 in both VSX routing table

[Chris_Atkinson]

Has each gateway had its policy installed recently, how long has each been up?

Can we please also see the following output from each VS.... the topology seems not correct.

netstat -rn

ip route get x.y.z.0

[Wolfgang]

@an_technical  I believe your topology is a little bit wrong. You have a layer 2 connect between both VS via 2 virtual switches. That‘s ok, but all attached interfaces are on different IP subnets, so no routing is possible between VS1 and VS2 and vice versa. And additional you have always two connects between both VSs, this must be observed with priorities.

I believe you‘re talking only about route propagation via the route configuration settings in the VS object not any other dynamic routing protocol like OSPF or BGP …?

[the_rock]

Im not vsx guru by any means, but purely from routing perspective, makes total sense.

Andy

[an_technical]

Thanks @Wolfgang : Yes you are right. I corrected the interface IP on wrp interface and I see route is propagated now. I am propagating the internal segment routes but these are propagated through external vswitch.

I am not able to find anything where we can propagate these through internal switch. Any suggestions pleas?

@Chris_Atkinson @the_rock 

[the_rock]

No option to do it via topology?

Andy

[an_technical]

I can add manual static routes by disabling route propagation but we have large number of routes.

[Wolfgang]

@an_technical you have a redundant connection between both VS, with VSX route propagation there is no way to differentiate an prioritize. You can remove one of the vswitches or you have to define the routes manually.

With vsx_provisioning_tool you can define a large range of routes via script.

[Chris_Atkinson]

Note sure if it behaves differently in newer supported versions without testing, refer also:

https://community.checkpoint.com/t5/Security-Gateways/VSX-route-propagation-with-more-then-one-vSwit...

[an_technical]

Is there any known issue on R81.20 Version 631? 

[the_rock]

I agree with Chris 100%. You should upgrade to officially supported version, which is at least R81.10 at the moment, but I would recommend R81.20 if possible.

Andy