Where Used on VPN Community object is wrong

[SimonMeadows]

Hi,

While working on some clean-up I have discovered that the where-used feature of smart console does not return results for vpn communities that are used for ipsec vpns.

I had a few that show 'No Usages Found' even though they are used and when deleted the ipsec vpns break.

I also notice the API call for 'where-used' also shows no uses for the objects.

Additionally the API call for 'show-unused-objects' lists the vpn community objects as being unused.

I have found this only to be true for vpn community objects that are not directly in any rules or policies.

It would seem we should be weary of deleting objects that show as unused because it isn't always true.

[Bob_Zimmerman]

This is probably the result of what exactly Where Used... is doing. It's trying to find references other objects have to this object. The problem is VPN communities don't need to be referenced by anything else to be functional. Thus, they may not be used by any other objects, but they are used by the configuration.

Route-based VPNs need a community to be defined, as that is where you set the negotiation parameters, but the community cannot be used in any rules.

Normal domain-based VPNs can be defined, and traffic can work due to rules matching "Any Traffic" in the VPN column by default.

Objects for traffic endpoints can have automatic NAT defined, which doesn't count as using the object for Where Used..., even though deleting the object can break traffic.

You are correct that "This object is not used" is not the same as "This object is safe to delete". They're two different questions, and the latter does require deeper knowledge of the object's history in the environment.