Question on VSX - !IP address mismatch

**danjun** · 2017-01-10

Hi,

does someone have an idea why I'm geting all these !IP address mismatches on my SmartCenter for my VSX cluster for each an every Warp-connection? Is this because of unnumbered interfaces? And what is your recommendation for virtual routers compared to physical ones in general?

Code:

[Expert@SmartCenter:0]# vsx_util show_interfaces

Type: Virtual Router

Interfaces configuration table:

+--------------------------------------------------------+-----+-------------------+
|Interfaces                                              |Mgmt |VSX GW(s)          |
+----------+---------------------------------------------+-----+---------+---------+
|Name      |           IP / Mask length                  |     |  VSX1   |   VSX2  |
+----------+---------------------------------------------+-----+---------+---------+
|wrpj128   |v4 192.168.10.172/32                         |  V  |   !IP   |   !IP   |
|wrpj192   |v4 192.168.10.172/32                         |  V  |   !IP   |   !IP   |
|bond4     |v4 20.20.20.20/28                            |  V  |    V    |    V    |
|bond3     |v4 192.168.10.172/28                         |  V  |    V    |    V    |
+----------+---------------------------------------------+-----+---------+---------+
Interfaces Table Legend:

  V   - Interface exists on the gateway and matches management information (if defined on the management).
  -   - Interface does not exist on the gateway.
 N/A  - Fetching Virtual Device configuration from the gateway failed.
 !IP  - Interface exists on the gateway, but there is an IP address mismatch.
!MASK - Interface exists on the gateway, but there is a Net Mask mismatch.

Thanks in advance!

**mcnallym** · 2017-01-10

Well is your real interfaces that showing the mismatch, do you have unnumbered VTI proxying with these Interfaces that mismatching.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&soluti onid=sk79700&partition=General&product=VSX"

Might want to read the above link as VTI isn't supported on VSX, so could be your issue

In terms of Virtual Routers vs Real Routers, then the main thing is that the Virtual Routers mean that you have to run your VSX in HA mode and cannot split the Virtual Systems across the VSX Cluster Members.

The one advantage that they have is that easy to deploy however you can use Cisco VRF to supply multiple routers to your VSX infrastructure and then still Load Share on the VSX.

**varera** · 2017-01-12

Originally Posted by danjun

Hi,

does someone have an idea why I'm geting all these !IP address mismatches on my SmartCenter for my VSX cluster for each an every Warp-connection? Is this because of unnumbered VTIs? And what is your recommendation for virtual routers compared to physical ones in general?

Code:

[Expert@SmartCenter:0]# vsx_util show_interfaces

Type: Virtual Router

Interfaces configuration table:

+--------------------------------------------------------+-----+-------------------+
|Interfaces                                              |Mgmt |VSX GW(s)          |
+----------+---------------------------------------------+-----+---------+---------+
|Name      |           IP / Mask length                  |     |  VSX1   |   VSX2  |
+----------+---------------------------------------------+-----+---------+---------+
|wrpj128   |v4 192.168.10.172/32                         |  V  |   !IP   |   !IP   |
|wrpj192   |v4 192.168.10.172/32                         |  V  |   !IP   |   !IP   |
|bond4     |v4 20.20.20.20/28                            |  V  |    V    |    V    |
|bond3     |v4 192.168.10.172/28                         |  V  |    V    |    V    |
+----------+---------------------------------------------+-----+---------+---------+
Interfaces Table Legend:

  V   - Interface exists on the gateway and matches management information (if defined on the management).
  -   - Interface does not exist on the gateway.
 N/A  - Fetching Virtual Device configuration from the gateway failed.
 !IP  - Interface exists on the gateway, but there is an IP address mismatch.
!MASK - Interface exists on the gateway, but there is a Net Mask mismatch.

Thanks in advance!

If you mean VPN VTIs, they are not supported.

**danjun** · 2017-01-12

I was referring to unnumbered interfaces, not unnumbered virtual tunnel interfaces (VTI).

**varera** · 2017-01-12

There is something wrong with your warp interfaces. It seems two different ones have the same address:

wrpj128 v4 192.168.10.172/32
wrpj192 v4 192.168.10.172/32

Did you assign this IP address manually? warp do not need IP addresses when connected to a virtual switch and may not need IP address when connecting to VR. Without more details it is hard to say why it is wrong exactly, but two different warp interfaces should not have the same IP address.