topic Cascading interface faiilure in Firewall and Security Management

Cascading interface faiilure

Michael_Horne — Mon, 27 Jun 2022 07:32:16 GMT

Hello All,

Is it possible to cascade link failure form one interface to another. If the Internet facing link fails, then we want to take down a specific interface on the Check Point gateway. When the Internet facing link comes up, then the specific interface is reactivated. There are monitored IPs, but there seems no way to link the status of an interface to a monitored IP.

We are looking at if Check Point can replace Fortinet for particular customer and this is one feature the Fortinet has, that I cannot find a similar feature for on the Checkpoint.

The Fortinet feature is the following, if Port3 goes down then Port 4 is also shutdown.

It woudl be possible with a script that is running periodically on the gateway, but a customized script is something that the customer would feel comfortable supporting.

Many thanks,

Michael

Re: Cascading interface faiilure

Chris_Atkinson — Mon, 27 Jun 2022 08:08:08 GMT

Is there dynamic routing used in this environment?

If the interfaces are bridged you have the option of Link State Propagation:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Installation_and_Upgrade_Guide/Topics-IUG/Configuring-Link-State-Propagation.htm

Re: Cascading interface faiilure

Michael_Horne — Mon, 27 Jun 2022 08:52:42 GMT

Hello Chris,

The FW is running in routed mode.

Regards,

Michael

Re: Cascading interface faiilure

Timothy_Hall — Mon, 27 Jun 2022 12:30:52 GMT

If you are using ClusterXL you can adapt the clusterXL_monitor_ips script to do what you want. sk92904: How to configure $FWDIR/bin/clusterXL_monitor_process script to run automatically on Gaia / SecurePlatform OS

This script is used to ping an IP address and then issue a pnote when the IP no longer responds, thus causing a failover. Replace the following lines in the script:

$FWDIR/bin/cphaconf set_pnote -d host_monitor -t 0 -s ok register -----> Comment out this line

$FWDIR/bin/cphaconf set_pnote -d host_monitor -s problem report -----> ifdown (interfacename)

$FWDIR/bin/cphaconf set_pnote -d host_monitor -s ok report -----> ifup (interfacename)

Note that downing an interface like this will cause a failover due to an Interface Active Check pnote being triggered.