Warning about topology when installing a policy with the Internet object

[Martijn]

Hi All,

Customer has a legacy VSX cluster with two 9700 appliances on R82 take 39. On this VSX cluster a Virtual System is configured to handle traffic to and from the internet.

The Application Control policy contains rules with the Internet object as destination and an External interface is configured on the Virtual System. But when installing the policy we see the following warnings:

Layer 'VS1-policy Application': Rule 2: The policy target vsx_member-a_VS1 does not have the required topology configuration in its interface(s). When you select the Internet object in the Destination column of a rule, you must configure the topology of the applicable interface (that connects to the Internet):
1) If this target is a Security Gateway or a regular Cluster, then the interface topology must be 'External' or 'DMZ'.
2) If this target is a Geo Cluster (the option 'Use Geo Mode in a Cloud' is enabled), then the interface topology must be 'External'.
Without the correct interface topology configuration, Security Gateways and Cluster Members cannot match traffic to this rule.

We are only seeing this for member vsx-member-a_VS1 of the VSX cluster. The other member (vsx-member-b_VS1) seems to be OK.

We checked everything and the External interface is configured with the correct Topology.

Anyone seen this before? Any idea where to look?

Regards,
Martijn

[Martijn · Accepted solution]

Hi,

Update from my side.

Talked to TAC en when checking the external interface via GUIDBEdit, we found out the setting 'leads_to_internet' was set to false. After changing this setting to true and install policy, the installation warnings where gone.

Why this setting was set to false while SmartConsole shows the interface as External is unknown. But glad is it resolved.

Regards,
Martijn

[Vincent_Bacher]

---

GUIDBEdit

---

It's always amazing how often you still have to work with the good old tool. But the main thing is that the problem is solved! 👍