topic Re: ClusterXL - PBR for Internet connection, IPSec VPN, Client VPN, and NAT(R80.40) in Firewall and Security Management

ClusterXL - PBR for Internet connection, IPSec VPN, Client VPN, and NAT(R80.40)

hdas — Mon, 14 Jun 2021 09:05:16 GMT

Hello,

I'm planning to configure the ClusterXL with 4 internet connections and PBR, I would like to know if it will work also for the VPN IPSec, VPN Client, and NAT.

VPN IPsec on the first internet connection
VPN Client on the second internet connection and some Static NAT
NAT on the third connection
No PBR on the fourth internet connection (default route)

Regards

Re: ClusterXL - PBR for Internet connection, IPSec VPN, Client VPN, and NAT(R80.40)

PhoneBoy — Wed, 16 Jun 2021 22:05:33 GMT

The appropriate Link Selection setting would be needed for the VPN to work properly.
Not sure what you mean by "NAT on the third connection" can you clarify?

Re: ClusterXL - PBR for Internet connection, IPSec VPN, Client VPN, and NAT(R80.40)

hdas — Thu, 17 Jun 2021 11:26:43 GMT

Hi PhoneBoy,

thanks for your reply.

Let me describe better what I want to achieve:

VLAN1 should be reachable only from the VPN IPsec & Client VPN and should be able to surf the internet + PBR Next-Hop 1st internet connection.
VLAN2 should be able to surf the internet and Static NAT (map some internal IP to external IP) + PBR Next-Hop 2nd internet connection.
VLAN3 should be able to surf the internet + PBR Next-Hop 3rd internet connection.
VLAN4 should be able to surf the internet = No PBR default route (routing table)
VLAN2, VLAN3, VLAN4 should be able to communicate.

The ClusterXL is the default gateway for all 4 VLANs.

Now, how can I implement all this?

Is there any drawback or limitation for the VPN traffic?

Thank you,

Re: ClusterXL - PBR for Internet connection, IPSec VPN, Client VPN, and NAT(R80.40)

Vladimir — Thu, 17 Jun 2021 11:58:26 GMT

Hmm.. rather odd setup imho... but if you look at the Link Selection/reply from the same interface, that should cover inbound traffic. That said, I believe the PBR has some limitations that may be material to you. Not sure what version you are on, but those listed in SK100500 were still applicable to R80.40.

Re: ClusterXL - PBR for Internet connection, IPSec VPN, Client VPN, and NAT(R80.40)

PhoneBoy — Thu, 17 Jun 2021 18:28:16 GMT

Properly setting the Link Selection and VPN community is required to ensure only the relevant VLANs are accessible and the VPN will transit the correct link.
You'll need appropriate PBR Routes for all of this for VLAN1-3.
Since you're talking about Default Route, make sure you're at least on R80.30.
VLAN2-4 should be able to talk assuming routes and Access Policy is defined appropriately.

You've not mentioned what should happen if one of these Internet connections fails.
The VPN would be most impacted by this, but I believe the other parts of this should work.

Re: ClusterXL - PBR for Internet connection, IPSec VPN, Client VPN, and NAT(R80.40)

hdas — Fri, 18 Jun 2021 08:30:46 GMT

Hi PhoneBoy,

very good point "You've not mentioned what should happen if one of these Internet connections fails." - Just to make things easier, I'll implement some FHRP (VRRP or HSRP) as the next-hop for the PBR.

"Since you're talking about Default Route, make sure you're at least on R80.30." - I'm on R80.40 now 😊

Could you kindly share a configuration template for the PBR? 😁

Thank you

Re: ClusterXL - PBR for Internet connection, IPSec VPN, Client VPN, and NAT(R80.40)

PhoneBoy — Mon, 21 Jun 2021 01:14:23 GMT

Sorry, I don't have a configuration template.
I would refer you to the following SKs for information:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk100500
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk167135