topic Re: Virtual Router - PA Equivalent in Firewall and Security Management

Virtual Router - PA Equivalent

Krishnan — Mon, 13 Apr 2020 05:26:33 GMT

Hi,

Currently we have a PA Firewall (800 series) on which he has created two virtual routers and one is used for voice traffic which has a different gateway and the other one has data which has a different networks and different ISP. How can it be achieved in Checkpoint Firewall ? I know we can use PBR for voice traffic however what is the exact equivalent for the same? This is very similar to vrf concepts. Can it be achieved in say 3200 Checkpoint Firewall ?

Re: Virtual Router - PA Equivalent

Chris_Atkinson — Mon, 13 Apr 2020 09:10:23 GMT

VSX provides virtualization of a security gateway and allows creation of Virtual Firewall Systems & Virtual Routers.

Re: Virtual Router - PA Equivalent

Krishnan — Sun, 19 Apr 2020 09:04:56 GMT

Hello,
How can we do without creating virtualization ?
1. If we are creating virtualization, do we need any license for that ?
2. Don't we have any equivalent to have different vrfs.

Re: Virtual Router - PA Equivalent

Chris_Atkinson — Sun, 19 Apr 2020 09:27:36 GMT

Two VS are included by default.

Paid license increments are 3,10,25,50

e.g.

CPSB-VS-3 (primary gateway)

CPSB-VS-3-VSLS (standby gateway)

Re: Virtual Router - PA Equivalent

Krishnan — Sun, 19 Apr 2020 09:31:54 GMT

But is there any equivalent for vrf with single instance instead of creating two ? Because in the existing they have a single instance of firewall with two virtual routers (PA). So will prefer the same.

Re: Virtual Router - PA Equivalent

Chris_Atkinson — Sun, 21 Jan 2024 13:18:05 GMT

Aside from MDPS the only other choice that may be relevant is multi-instance OSPF depending on your actual requirements.

Re: Virtual Router - PA Equivalent

Krishnan — Sun, 19 Apr 2020 09:40:25 GMT

Thanks Chris

Re: Virtual Router - PA Equivalent

ikafka — Sat, 20 Jan 2024 20:02:01 GMT

Hi Krishnan

Can you share how you resolved this situation? I need to find the best solution in the same situation right now.

Thanks.

Re: Virtual Router - PA Equivalent

Chris_Atkinson — Sun, 21 Jan 2024 13:20:40 GMT

Note with VSX, Virtual Routers don't consume a VS license.

Re: Virtual Router - PA Equivalent

Bob_Zimmerman — Sun, 21 Jan 2024 20:40:09 GMT

Did this change recently? Router contexts definitely did consume license slots in the past. I don't use router contexts, so I don't notice changes to how they work. The only VS type which I know has never consumed a slot is a switch.