XG Firewall v18 MR-3: Feedback and experiences

Hello, Im running v18 MR-3 over 5 days and Im having a seirous problem.

Currently we have a Ipsec tunnel established and working.

I have created a SDWAN rule to direct my traffic to internet using my WAN interface

and I have configured the route precedence to  

Routing Precedence:
1. VPN routes
2. Static routes
3. SD-WAN policy routes

The traffic From HO to Bo over ipsec interface it works correctly, but in random momments some hosts from BO Lan when try access hosts to HO Lan has the access interruped.

With a little troubleshooting I could check that in this momment the Hosts from BO try access the hosts to HO over WAN interface, even the ipsec tunnel is UP and other hosts from the same subnet BO LAN is working over IPSEC tunnel.

It seems that route precedence sotp to works and redicrect the traffic over SDWAN rule. 

Does someone has any experience like this!?

Regards

Carlos

Hello, Im running v18 MR-3 over 5 days and Im having a seirous problem.

Currently we have a Ipsec tunnel established and working.

I have created a SDWAN rule to direct my traffic to internet using my WAN interface

and I have configured the route precedence to  

Routing Precedence:
1. VPN routes
2. Static routes
3. SD-WAN policy routes

The traffic From HO to Bo over ipsec interface it works correctly, but in random momments some hosts from BO Lan when try access hosts to HO Lan has the access interruped.

With a little troubleshooting I could check that in this momment the Hosts from BO try access the hosts to HO over WAN interface, even the ipsec tunnel is UP and other hosts from the same subnet BO LAN is working over IPSEC tunnel.

It seems that route precedence sotp to works and redicrect the traffic over SDWAN rule. 

Does someone has any experience like this!?

Regards

Carlos

Hi Carlos,

We will try to reproduce the problem in our lab. In the mean time, could you please upload the config on HO and BO here ? Or if you could share the access to your device, we will debug the issue.

on the remote Firewall check the routes with route -e and on advanced console with console> system ipsec_route show

we have a case open where the routes into the tunnel are not visible and the XG does not know that the network is behind ipsec0 virtual interface. although on Web GUI in Diagnostics - Route lookup it lists the correct gateway.

Unlikely this is caused by the routing precedence. Instead the Policies of the Ipsec routes are a. deleted or b. the SA is dead. 

Hence XG will use the routing precedence. 

I would expect, that the VPN SA dies somehow. Thats kinda frequently seen issue, if there are problems with the tunnel itself. 

Hi LHerzog.

Thanks by reply, I just check  system ipsec_route show and the information are not visible

But only for information, we have a devices running with v18 MR1, with the same configs related.

Ipsec + SDWAn rules and it is working as expect. But checking it now, I cannot see the ipsec routes too.

regards

Carlos

Those cish ipsec_routes are "manually configured routes". Not the basic SA routes.

Please check the #ipsec status

Hi LuCar Toni, thanks by reply.

I believe that Ipsec routes are not deleted, because the problem does not happen with all network and yes with some hosts.

Eg. Host 1 from BO has this problema while Host 2 from BO continue to usage VPN without problem.

In this moment I have disabled the SDWAN rule and the problem it seems does not happen. Im still try identify where is the cause.

Regards

Carlos

Hi LuCar Toni

It is Ok

Please open another thread to keep the visibility here. 

Feel free to delete your comments here.