IPSec connection not used

Question

Hi all, 
 i have a ipsec-connectin, but packets didn't use these: 
 XGS2100_RL01_SFOS 19.0.1 MR-1-Build365# ip route show table 220 192.168.192.1 dev ipsec0 scope link src 192.168.179.254 
 XGS2100_RL01_SFOS 19.0.1 MR-1-Build365# ip route show table all default via 192.168.178.1 dev Port2 table wanlink1 proto static src 192.168.178.2 prohibit default table wanlink1 proto static metric 1 default via 192.168.178.1 dev Port2 table gw1 proto static prohibit default table gw1 proto static metric 1 default dev ipsec0 table routeipsec0 scope link default via 192.168.178.1 dev Port2 table multilink proto static 192.168.192.1 dev ipsec0 table 220 scope link src 192.168.179.254 10.0.0.0/8 via 192.168.92.114 dev Port1 proto zebra 10.0.1.0/24 dev PortMGMT proto kernel scope link src 10.0.1.1 linkdown 172.16.0.0/12 via 192.168.92.114 dev Port1 proto zebra 192.168.0.0/16 via 192.168.92.114 dev Port1 proto zebra 192.168.92.112/28 dev Port1 proto kernel scope link src 192.168.92.113 192.168.178.0/24 dev Port2 proto kernel scope link src 192.168.178.2 
 but packets use the other LAN-Port (Port1) but not the IPSec connection:

console> system route_precedence show Routing Precedence: 1. VPN routes 2. SD-WAN policy routes 3. Static routes console>

dirkkotte · Accepted Answer

a Workaround is helping ... i removed the 192.168.0.0/16 route to the LAN devices ... and create some more specific routes for currently needed connections 
 ... now the IPSec destination is being reached .... but this is not really a solution i think. 
 PS: i have a distance of "0" within the routing entries. ... is this ok?

dirkkotte · Answer

Found the following: 
 https://support.sophos.com/support/s/article/KB-000038775?language=en_US 
 ".... If for example, a particular subnet is accessible over an IPSEC VPN and is also covered by a static route directed to a router in the LAN zone, then the route_precedence command cannot be used to control which route is used." 
 Really great ... 
 
 A known issue:

LuCar Toni · Answer

Route Based is not a Workaround. It is a better technology. 
 And yes, this is not needed in Route Based as well. 
 Policy Based is an old, flunky technology, which has plenty of downsides.

IPSec connection not used

Top Replies