VSX Virtual Router Issue

[Pim_Dimmedal]

I have an issue regarding VSX and the implementation of ClusterXL combined with a virtual router. I've created a lab setup (see attachment) and did some testing.

Internet connectivity on the EDGE router is verified:

1: I can ping 8.8.8.8 and google.com from my EDGE router

2: When I connect my client directly to my EDGE router i can also ping 8.8.8.8 and google.com

Connectivity from the client:

Ping from Client to 192.168.20.3 (Virtual System) is successful

Ping from Client to 192.168.1.2 (Virtual Router) is successful

Ping from Client to 192.168.1.1 (EDGE Router) is not successful

Ping from Client to 8.8.8.8 and google.com is not successful (obviously)

Connectivity from the virtual router (login to corresponding Virtual System ID of the router)

Ping from Virtual Router to 192.168.1.1 (EDGE Router) is successful

Ping from Virtual Router to 8.8.8.8 and google.com is successful

Ping from Virtual Router to 192.168.10.3 (Virtual System) is successful

Ping from Virtual Router to 192.168.20.4 (Client) is successful

It looks like the Virtual Router can connect to every part of the network but from the client I'm not able to get past the Virtual Router.

Does anyone know what I'm missing here?

[Valeri_Loukine]

You are missing the NAT for VS IP address :-) It is most probably pinging 8.8.8.8 with a funny IP address which is not routed back. Run fw monitor to prove

[Pim_Dimmedal]

I will run fw monitor tonight, but I'm using NAT on my EDGE router so I don't see the need to NAT on the VS as well.

[Valeri_Loukine · Accepted solution]

Well, it particular cases VSX entities are using non-routable IP addresses that just cannot be returned to the original source. Start there, see where it fails, and then, if that was not the case, we can move further

[Pim_Dimmedal]

I've found the issue. It seemed something was wrong with the route back from the EDGE to the Virtual Router.

Thanks for your suggestion.

[Happy__]

I faced the same issue in my lab, I have two VS both external interface is connected with a virtual router, I able to reach to the virtual router but not getting the internet.

The virtual router is getting internet, I try to do with netting on VS with virtual router IP but policy failed.

There is any document related to this issue.

Can anyone help me to understand it?

"Well, it particular cases VSX entities are using non-routable IP addresses that just cannot be returned to the original source."

[Pim_Dimmedal]

Sorry for the late reply. Have you defined a route on the virtual router to both virtual systems, and a default route on both virtual systems to the virtual router? 

[Happy__]

Yes, I defined the default route is a virtual router for both VS and also defined routes on VR for reverse.