Hi Vikas
Thanks for your reply.
That is correct, I have a tunnel between the DMZ zones of my two ssg5's.
The host is on the other side of the tunnel. I can ping bothways through the tunnel.
the result of get route ip 10.238.135.227 and I also added some relevant config.
-> get route ip 10.238.135.227
Dest for 10.238.135.227 -------------------------------------------------------------------------------------- none potential routes in other vrouters: untrust-vr : => 10.238.135.224/28 (id=6) via 0.0.0.0 (vr: utrust-vr) Interface tunnel.2 , metric 1
-> get route id 6 route in untrust-vr
-------------------------------------------------------------------------------------- id: 6
IP address/mask: 10.238.135.224/28
next hop (gateway): 0.0.0.0
preference: 20
metric: 1
description:
outgoing interface: tunnel.2
vsys name/id: Root/0
tag: 0
flag: 24002040/00100001
type: static
Redistrubuted to:
status: active (for 5 days 0 hours 38 minutes 10 sseconds)
rotue in trust-vr
--------------------------------------------------------------------------------------
id: 6
IP address/mask: 10.238.135.117/32
next hop (gateway): 0.0.0.0
preference: 0
metric: 0
description:
outgoing interface: ethernet0/3
vsys name/id: Root/0
tag: 0
flag: 340000000/00100000
type: host
status: active (for 7 days 10 hours 0 minutes 53 sseconds)
Then there is one more in the third vr
Here is the route config.
The route in question:
set route 10.238.135.224/28 interface tunnel.2
set route 10.238.135.224/28 interface null metric 10
The tunnel config:
set vpn "dmz.tunnel" gateway "gateway" no-replay tunnel idletime 0 proposal "g2-esp-aes128-sha"
set vpn "dmz.tunnel" monitor source-interface loopback.2 destination-ip 10.238.135.225 optimized rekey
set vpn "dmz.tunnel" id 0x15 bind interface tunnel.2 set vpn "dmz.tunnel" dscp-mark 0
set interface "tunnel.2" zone "DMZ" set interface tunnel.2 ip unnumbered interface bgroup2.1
set interface loopback.2 ip 10.238.135.222/28
set interface loopback.2 route
If i ping from loopback interface.2:
-> ping 10.238.135.227 from loopback.2 Type escape sequence to abort Sending 5, 100-byte ICMP Echos to 10.238.135.227, timeout is 1 second from loopback.2 !!!!! Sucess Rate is 100 procent (5/5), round-trip time min/avg/max=13/21/50 ms