Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

XGS 3300 wrong Gateway

Hi, I've got the following case:

HA XGS3300

Three WAN connectinons

P2 ISP 1

P4 ISP 1

P6 ISP 2

P2 and P4 are BGP.

P6 is stand alone.

All internet connections are working.

When configuring SNAT and or SD-WAN all traffic for WAN is over port 4, none is going to port 6.

Checking the logs it selects the correct FW and NAT policy, then the requested GW is correct but port OUT is P4.

We have the same setup with an other customer reviewed everything, with the other customer it is working fine, always the correct nat policy an correct gateway.

Only difference we can find is this:

Advanced CLI:

route -n

 

There is a default route 0.0.0.0 to port4, we don't have them anywhere on any of our other customers FW's.

It's not in the Gui anywhere and not on the normal console.

Don't know where this default route is coming from or how to get rid of.

Kind regards,



Edited TAGs
[edited by: Raphael Alganes at 11:31 AM (GMT -8) on 7 Nov 2024]
Parents Reply Children
  • Yes it's in the BGP route tabel:

    Current configuration:

    !

    frr version 8.4.2

    frr defaults traditional

    !

    hostname bgp

    log stdout

    !

    !

    !

    router bgp 4200030937

    bgp router-id x.x.x.x

    bgp log-neighbor-changes

    no bgp ebgp-requires-policy

    no bgp hard-administrative-reset

    no bgp graceful-restart notification

    neighbor x.x.x.x remote-as 4200030921

    neighbor x.x.x.x remote-as 4200030923

    !

    address-family ipv4 unicast

      network x.x.x.x/29

      neighbor y.y.y.y prefix-list aoa-import in

      neighbor y.y.y.y prefix-list aoa-export out

      neighbor z.z.z.z prefix-list aoa-import in

      neighbor z.z.z.z prefix-list aoa-export out

    exit-address-family

    !

    exit

    !

    ip prefix-list aoa-import seq 10 permit 0.0.0.0/0

    ip prefix-list aoa-import seq 20 deny 0.0.0.0/0 le 32

    ip prefix-list aoa-export seq 10 permit x.x.x.x/29

    ip prefix-list aoa-export seq 20 deny 0.0.0.0/0 le 32

    !

    !

    !

    line vty

    no login

    exit

    !

    Bart van der Horst


    Sophos XG v18(.5) / v19 Certified Architect
    https://www.bpaz.nl

  • If i remove the filter list the BGP breaks down. Not sure wat to do. 

    Bart van der Horst


    Sophos XG v18(.5) / v19 Certified Architect
    https://www.bpaz.nl