We are having some problems with our VSX gateway in a Maestro setup. One of the VS's is setup as a VPN concentrator on a dedicated customer network and the other interface has a connection to some backend servers.
On a customer site there is a box that runs a Cloudguard IAAS version of a gateway that is connected to the smae dedicated customer network and will initiate the tunnel.
Hardware: MHO140, thsi SG has 1 x 5800 gateway
R80.20SP with JHF 258
VS VPN-concentrator has IP 1.5.1.2
Cloadguard GW has IP 2.4.5.50 but has link selection set to static nat to IP 1.5.1.137
Packets arriving at the VS are dropped with the message in the log: Missing OS route
fw ctl zdebug drop shows this message:
fw_first_packet_outbound_init Reason: failed to get outbound interface;
Packet trace from the vs0 shows packets :
Inbound packet:
BPEth0[in ]: vlan 3620, p 0, ethertype IPv4, 1.5.1.137.10400 > 1.5.1.2.500: isakmp: phase 1 I #34[]
bond1.614[in ]: 1.5.1.137.10400 > 1.5.1.2.500: isakmp: phase 1 I #34[]
Outbound packet:
wrp321[out]: 1.5.1.2.500 > 1.5.1.137.500: isakmp: phase 1 I #34[]
wrpj321[in ]: 1.5.1.2.500 > 1.5.1.137.500: isakmp: phase 1 I #34[]
bond1.614[out]: 1.5.1.2.500 > 1.5.1.137.500: isakmp: phase 1 I #34[]
bond1[out]: 1.5.1.2.500 > 1.5.1.137.500: isakmp: phase 1 I #34[]
eth1-10[out]: 1.5.1.2.500 > 1.5.1.137.500: isakmp: phase 1 I #34[]
BPEth0[out]: vlan 1033, p 0, ethertype IPv4, 1.5.1.2.500 > 1.5.1.137.500: isakmp: phase 1 I #34[]
ethsBP1-01[out]: vlan 1033, p 0, ethertype IPv4, 1.5.1.2.500 > 1.5.1.137.500: isakmp: phase 1 I #34[]
All I can find with the failed to get outbound interface message was a SK about a bridged interface and a normal interface communication that was not properly working after an upgrade.
Regards, Maarten