topic Re: Check Point AWS Direct Connectivity BGP ECMP in Firewall and Security Management

Check Point AWS Direct Connectivity BGP ECMP

Blason_R — Sat, 30 Jul 2022 03:43:30 GMT

Hi Team,

I have been asked to deploy 4 links to AWS DX connectivity. This is over BGP and I wanted to enable BGP ECMP so that all those links will be utilized. However I wanted to confirm if the traffic leaves from LAN to AWS will be delivered from the same link and if not will firewall accept the connection if receives from other link since its gonna be asynchronous routing.

Here is diagram -

Any specific considerations?

Re: Check Point AWS Direct Connectivity BGP ECMP

Chris_Atkinson — Sat, 30 Jul 2022 04:23:27 GMT

As is so long as anti-spoofing is configured correctly to permit traffic on the available paths and the same Firewall see both sides of the flow this shouldn't be a problem.

For more information on BGP ECMP and the consideration for the configuration please see sk100504.

Re: Check Point AWS Direct Connectivity BGP ECMP

Blason_R — Sun, 31 Jul 2022 07:23:38 GMT

Yeah - Thanks for the response. So I hope I dont need to disable best-path selection policy of something. Just like in my other router setup I had to relax best path selection. In case of Check Point if all the attributes match and have ecmp enable I should see multiple paths added in route table.

Re: Check Point AWS Direct Connectivity BGP ECMP

Chris_Atkinson — Sun, 31 Jul 2022 08:37:58 GMT

To an extent that's what route-maps are for to adjust local_pref or as-path pre-pending to make the paths seem equal when attributes aren't necessarily as you need them.