VTI Numbered to Unnumbered Peer Interop

[stallwoodj]

Hi,

I'm in the process of investigating a conversion from non-CP firewall to VSX virtual firewall.

The current device has lots of unnumbered (route-based) tunnels to third parties with various different vendor firewalls. VSX requires VTI's to have IP addresses.

A quick test between my lab VSX and a standalone CP with an unnumbered VTI (statements such as "set static-route 192.0.2.1/32 nexthop gateway logical vpnt9 on") seems on cursory testing to work.

Has anyone else used numbered VTI's interoperating with remote unnumbered tunnels, is it supported and are there any caveats please?

Thanks!

Jamie

[PhoneBoy]

I've never heard of any issues one way or another.

[Bob_Zimmerman · Accepted solution]

The numbering of VTIs is only locally-significant. Numbered and unnumbered work just fine for passing traffic. You won't be able to talk firewall-to-firewall (since one of the firewalls won't recognize the traffic as being for itself), but that's generally only used for dynamic routing over the VTI.

[the_rock]

I seen customers do that before and it does work. Not sure if its officially supported, but works fine.

Andy