- Products
- Learn
- Local User Groups
- Partners
-
More
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
IDC Spotlight -
Uplevel The SOC
Important! R80 and R80.10
End Of Support around the corner (May 2021)
I have an issue regarding VSX and the implementation of ClusterXL combined with a virtual router. I've created a lab setup (see attachment) and did some testing.
Internet connectivity on the EDGE router is verified:
1: I can ping 8.8.8.8 and google.com from my EDGE router
2: When I connect my client directly to my EDGE router i can also ping 8.8.8.8 and google.com
Connectivity from the client:
Ping from Client to 192.168.20.3 (Virtual System) is successful
Ping from Client to 192.168.1.2 (Virtual Router) is successful
Ping from Client to 192.168.1.1 (EDGE Router) is not successful
Ping from Client to 8.8.8.8 and google.com is not successful (obviously)
Connectivity from the virtual router (login to corresponding Virtual System ID of the router)
Ping from Virtual Router to 192.168.1.1 (EDGE Router) is successful
Ping from Virtual Router to 8.8.8.8 and google.com is successful
Ping from Virtual Router to 192.168.10.3 (Virtual System) is successful
Ping from Virtual Router to 192.168.20.4 (Client) is successful
It looks like the Virtual Router can connect to every part of the network but from the client I'm not able to get past the Virtual Router.
Does anyone know what I'm missing here?
Well, it particular cases VSX entities are using non-routable IP addresses that just cannot be returned to the original source. Start there, see where it fails, and then, if that was not the case, we can move further
You are missing the NAT for VS IP address 🙂 It is most probably pinging 8.8.8.8 with a funny IP address which is not routed back. Run fw monitor to prove
I will run fw monitor tonight, but I'm using NAT on my EDGE router so I don't see the need to NAT on the VS as well.
Well, it particular cases VSX entities are using non-routable IP addresses that just cannot be returned to the original source. Start there, see where it fails, and then, if that was not the case, we can move further
I've found the issue. It seemed something was wrong with the route back from the EDGE to the Virtual Router.
Thanks for your suggestion.
I faced the same issue in my lab, I have two VS both external interface is connected with a virtual router, I able to reach to the virtual router but not getting the internet.
The virtual router is getting internet, I try to do with netting on VS with virtual router IP but policy failed.
There is any document related to this issue.
Can anyone help me to understand it?
"Well, it particular cases VSX entities are using non-routable IP addresses that just cannot be returned to the original source."
Sorry for the late reply. Have you defined a route on the virtual router to both virtual systems, and a default route on both virtual systems to the virtual router?
Yes, I defined the default route is a virtual router for both VS and also defined routes on VR for reverse.
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY