topic Re: No of PBR limitations in Firewall and Security Management

No of PBR limitations

Balakrishna_Med — Sat, 18 May 2019 17:11:39 GMT

Hi,

We are facing the issue with No.of PBRs,

Scenario... We have Juniper Switch with Virtual routers... we have installed Checkpoint IPS between Juniper Firewall and Juniper Switch... and we are routing the traffic through Checkpoint using PBR.

Support person not recommending more PBR(No.of PBR are 15)

Is it really limitation from Checkpoint 80.10? any suggestions please...

Thanks

Bala

Re: No of PBR limitations

Danny — Sat, 18 May 2019 20:42:00 GMT

There is no limit of PBR rules. Check Point officially declares in sk100500 that "You can define many Policy Rules."

Check Point does not note how many, but many for me means that only 15 PBR rules should be no issue at all.

Re: No of PBR limitations

Licensing_User — Thu, 19 Jan 2023 12:59:42 GMT

Hello Danny,

We have a similar situation with one of our clients, the only issue is "many" in our case means we need 2500 PBR.

Check Point advised that "many" means 1024 only, so we have to go for a Linux PBR solution.

These routes will only stay for 3-6 months and will go to a single DG once the local network migration is complete.

My question is; will all limitations still apply if we implement PBR via Linux commands and 2500 individual rules?

do you foresee any challenges in doing this or any work around that can be helpful, Please?

Thanks

Re: No of PBR limitations

Licensing_User — Fri, 20 Jan 2023 15:33:31 GMT

Hello All,

Can anyone please reply to the above question if they know about this, please?

Thanks

Re: No of PBR limitations

PhoneBoy — Fri, 20 Jan 2023 19:58:42 GMT

If you're trying to modify PBR with Linux commands (via expert mode) on the gateway, that is most definitely not supported.
If you're implementing the PBR on an external device, that's up to the external device.

What version/JHF are we talking about here?

Re: No of PBR limitations

Licensing_User — Mon, 23 Jan 2023 10:15:52 GMT

Thanks for your reply.

we had a TAC case opened with ref:6-0003441780, and it was advised that the Linux commands could be used.

It was our SD who was involved with CP TAC, but I will confirm the current version asap.

Thanks

Re: No of PBR limitations

Licensing_User — Mon, 23 Jan 2023 11:07:25 GMT

Its R80.40 T180

Re: No of PBR limitations

PhoneBoy — Mon, 23 Jan 2023 16:34:37 GMT

It depends on where the PBR limit is coming from (the Linux kernel or the Gaia configuration DB).
That might be a question for TAC, though I am also asking out of band.

Re: No of PBR limitations

Sundeep_Mudgal — Mon, 23 Jan 2023 19:46:37 GMT

Gaia ultimately pushes these rules to kernel so same limitations should apply either way. Please open a RFE request if you need 2500 PBR rules to be supported in Gaia.

Re: No of PBR limitations

Licensing_User — Tue, 24 Jan 2023 23:20:44 GMT

Ok, Thanks for that. I did open a new TAC case, but no response yet. please let me know if you find out anything.

Thanks

Re: No of PBR limitations

PhoneBoy — Wed, 25 Jan 2023 01:02:18 GMT

TAC will ultimately tell you the same thing that @Sundeep_Mudgal answered as his team in R&D is responsible for PBR functionality in Gaia.
Recommend raising this requirement with your local Check Point office.

Re: No of PBR limitations

Licensing_User — Wed, 25 Jan 2023 09:06:03 GMT

Thanks for the info @Sundeep_Mudgal

Re: No of PBR limitations

Licensing_User — Wed, 25 Jan 2023 09:23:17 GMT

@Sundeep_Mudgal , it seems the RFE is a general feature request and might not be implemented. can a custom hotfix be provided if we contact local CP or a request via TAC?

Re: No of PBR limitations

PhoneBoy — Thu, 26 Jan 2023 03:06:40 GMT

While it wouldn't hurt to file an RFE, this request should be handled through your local Check Point office.