SDWAN and Loopback Interfaces

[Jeff Wolf]

I am seeing 2 loopback interfaces that I'm not sure how they were implemented.  I'm not seeing them in any of the device templates or feature templates.  Our internal security team runs Nessus scans and is picking up a DNS snooping vulnerability.

It appears they are configured in the global config and not the sdwan config..  Please advise on how to remove, if possible.

Loopback65528 192.168.1.1 YES other up up
Loopback65529 11.1.254.92 YES other up up

router#sh sdwan run | i 65528
router#sh run | i 65528
vrf definition 65528
interface Loopback65528
vrf forwarding 65528
ip nat route vrf 65528 0.0.0.0 0.0.0.0 global

Thanks in advance.

Jeff

[balaji.bandi]

we need to know full configuration to see what is added and what service it is.

we are not sure what is effects of removing this,

show run (post here)

check the interface associated and belowng to as per the guide :

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/system-interface/ios-xe-17/systems-interfaces-book-xe-sdwan/configure-interfaces.html

[Kanan Huseynli · Accepted solution]

Hi,

Loopback65528 in VRF 65528 is used for Zscaler API calls. Loopback is NAT-ed to VPN0 for internet access.

Loopback65529 in VRF 65529 is used for different purposes,one of them is for IPS management-port group (which can also require internet access via DIA).

https://help.zscaler.com/downloads/zscaler-technology-partners/network/zscaler-and-cisco-sd-wan-deployment-guide/Zscaler-Cisco-SD-WAN-Deployment-Guide-FINAL.pdf

https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-security-policy-design-guide.html

Search for "65528" and "65529" (without quotes) in these docs.