IPSEC - Routed VTI interface randomly assuming default gateway
-
The default gateway is set to automatic by default. When an IPsec VTI interface is set up it is allocated as a new gateway to the VPN network.
We have a Netgate-6100 that has been sporadically setting the default gateway to the IPSEC VTI interface. This has caused a lot of pain and suffering as it has been randomly routing all our traffic down the VPN.
I think it needs adding to documentation on Routed VTI to check the gateway setting and apply a fixed gateway if required.
-
While it may be unexpected for you, it's doing what it was told to do. Namely, it picked a default gateway automatically. It's safest to ship with that on automatic as it ensures the most likely path to success initially. Once you add more interfaces with gateways it's not so simple, though. It's easy enough to change the default gateway to a specific entry (or a gateway group expressing your automatic failover preference).
I thought we had a warning in the docs but I don't see one now. I'm probably thinking of WireGuard which does have a warning.
I'll look into adding a similar note to the VTI docs.
