topic Return packet from the same interface ? in Firewall and Security Management

Return packet from the same interface ?

Amir_Arama — Wed, 23 Mar 2022 15:44:41 GMT

Hi,

i want to know if there is support in checkpoint fw to return packet from the same interface original packet was received. specifically for 2 ISPs, without enabling isp redundancy.

i know there is sdwan module in development, but i don't know when it will be available as GA/EA.

Re: Return packet from the same interface ?

Chris_Atkinson — Thu, 24 Mar 2022 00:26:21 GMT

Is there any NAT or PBR involved, what is the direction of the traffic flow - External to DMZ?

Re: Return packet from the same interface ?

Amir_Arama — Thu, 24 Mar 2022 07:36:47 GMT

Hi,

i'm talking about inbound internet traffic for dmz published servers.

so for example our company website which has public ip's from both isp's and NLB does the GSLB, so one user can access 1st isp Nat IP, and other user might access 2nd isp Nat IP.

the FW does the Nat from public to private dmz ip.

how can i verify that if user A get through isp A, the return packet to user will go out through isp A, and the same for isp B.

Re: Return packet from the same interface ?

Chris_Atkinson — Thu, 24 Mar 2022 10:37:15 GMT

Sounds like a use case for PBR depending on your enabled blades.

What is the current routing setup for each ISP link, default route via only one or both?

Re: Return packet from the same interface ?

Amir_Arama — Wed, 30 Mar 2022 10:41:57 GMT

sorry for the late response. Current setup default route to one isp

With pbr for specific traffic to the other isp's