topic Re: PBR limitations in Firewall and Security Management

PBR limitations

GG27 — Fri, 03 Aug 2018 15:08:14 GMT

Hi Mates,

reading the sk100500 I was very surprised when it described

The following features/blades are not supported with PBR:

IPv6
Locally-generated traffic
Security Servers
Data Loss Prevention (DLP) blade
Anti-Spam blade
Mail Transfer Agent (MTA) (relevant for Threat Emulation/Threat Extraction/Data Loss Prevention/Anti-Spam blades)
ISP Redundancy
The following applications (which use Check Point Active Streaming [CPAS]):
- VoIP (H323, SIP, Skinny, etc.)
- HTTPS Inspection
- HTTP Header Spoofing
- HTTP Proxy
- IMAP in IPS

Despite my idea where, routing feature on the gateway musn't influence the security features, at the moment I need to have a PBR on a gateway where MTA is active for the TEX blade.

In the enviroment where I'd like to implement PBR and I have MTA enabled on a R80.10 gateway, the PBR doesn't work.

Does someone face the same scenario ?

Does someone know a workaround/solution?

Re: PBR limitations

PhoneBoy — Fri, 03 Aug 2018 22:18:56 GMT

Locally generated traffic accounts for most of the limitations, including MTA.

It would be useful to hear about your specific use case in a little more detail.

Re: PBR limitations

GG27 — Mon, 06 Aug 2018 08:11:02 GMT

the idea shoud be implement a PBR to move internet browsing from a proxy server inside the network throught out a new provider.

I implemented the PBR as I made in the past for other costumers, but it the first time the PBR doesn't work.

I mean running "IP RULE" command in expert mode on the gateway, I see the matches at my PBR.

Dumping the traffic, instead, the packets are forwarded by the route in the main route tables

Re: PBR limitations

PhoneBoy — Tue, 14 Aug 2018 02:07:52 GMT

Routing configuration changes needs to be done via clish and not using the ip command via expert mode.

Are you using the security gateway as the explicit proxy in this case?

Re: PBR limitations

GG27 — Mon, 03 Sep 2018 07:12:20 GMT

the "ip rule" command is described in the SK for debugging PBR on Secure Gateway.

obviously I implemented PBR from clish.

In reply at your question "Are you using the security gateway as the explicit proxy in this case?", the response is NO, I have an external proxy gateway.

Re: PBR limitations

PhoneBoy — Mon, 03 Sep 2018 16:50:32 GMT

So how is the traffic flowing from your clients to the Internet?

Since proxies are involved, need to understand where the TCP connections are terminating.

And are you using the Transparent proxy option?

Re: PBR limitations

GG27 — Tue, 04 Sep 2018 05:32:30 GMT

the browser on client is configured to use explicit proxy and the communication starts from client and terminate at the proxy end.

The proxy, then, initiates the connection to the web site

in other words, running tcpdump on gateway I see as source IP, the IP of proxy server

Re: PBR limitations

PhoneBoy — Tue, 04 Sep 2018 14:24:28 GMT

So do the packets from your internal proxy server terminate on another proxy server or just go to the Internet sites directly?

Also, my question about proxy mode, which you didn't answer.

The setting is here:

Re: PBR limitations

GG27 — Thu, 06 Sep 2018 15:51:59 GMT

Hi Dameon

The internal proxy goes out to the internet directly. No more proxy are in the middle between internal proxy and internet.

In reply CKP proxy configuration, the gateways are not configured as a proxy and the box on the property is not tricked.

Re: PBR limitations

PhoneBoy — Thu, 06 Sep 2018 22:30:58 GMT

I recommend opening a TAC case to troubleshoot this as, to the best of my knowledge, this should work.

Re: PBR limitations

D_W — Wed, 09 Oct 2019 07:42:38 GMT

Hi,

I also have a questions to the Limitations stated in SK100500.

We use URLFilter and IPS so the limitation is that those two features are not working for traffic that is handled by the PBR OR are those features without function for every traffic?

David

Re: PBR limitations

G_W_Albrecht — Wed, 09 Oct 2019 13:06:50 GMT

According to sk100500, IPS and URLF are not working with PBR.

Re: PBR limitations

D_W — Wed, 09 Oct 2019 13:09:30 GMT

Yes this SK100500 is telling us that but my question is if the whole IPS and URLF is not working/supported or only not supported/working for the PBR traffic?!

Re: PBR limitations

FedericoMeiners — Wed, 09 Oct 2019 13:50:32 GMT

I think that the limitations are pointing that you cannot make routing decisions based on those blades.

If not I would be really confused, I have many customers with PBRs and IPS and both blades are working like a charm.

Would be nice that someone from Check Point clarifies it, it's true that the sk is not clear enough.

Re: PBR limitations

Enrique — Wed, 12 Feb 2020 16:59:32 GMT

Hello,

Does anyone know if it is possible to configure Mobile Access with PBR?

I have two ISP in two different firewall's interfaces and we would like to publish only the Mobile Access portal with the ISP which is NOT the default gateway.

I've performed some traffic captures and fw monitor, and I clearly see that traffic is reaching through ISP2 but the returning traffic is being routed through ISP2.

Thank you to everyone in advance, I really really like this community.

Re: PBR limitations

Peter_Lyndley — Thu, 20 Feb 2020 12:33:25 GMT

It would be great if someone from Check Point could clarify this.

We have two open TAC cases for different customers and we cannot move forward as TAC are saying the blades you have enabled will not work with PBR.

It would be really helpful if someone could answer why, rather than just pointing us to this ambiguous SK

thanks

Peter

Re: PBR limitations

Nicolas_Vanhoek — Fri, 06 Mar 2020 15:35:09 GMT

see sk76281 -
did you select Reply from the same interface ?

When Responding to a Remotely Initiated Tunnel

When responding to a remotely initiated tunnel, there are two options for selecting the interface and next hop that are used. These settings are only relevant for IKE and RDP sessions.

These settings are configured in Link Selection > Outgoing Route Selection > Setup > Link Selection - Responding Traffic window.

Use outgoing traffic configuration - Select this option to choose an interface using the same method selected in the Outgoing Route Selection section of the Link Selection page.
Reply from the same interface - This option sends the returning traffic through the same interface and next hop it that it arrived in.

Note - When Route Based Probing is enabled, Reply from the same interface is the selected method and cannot be changed.

Kind regards

Niky

Re: PBR limitations

Gro_Tea — Tue, 19 May 2020 06:38:24 GMT

Hi,

the post is long ago, but at the moment I'm facing some problems regarding pbr. I just wanted to ask you if you got any response from officials regarding the mentioned incompatibility with PBR and some core features?

Thanks in advance,

Frank