topic Re: PBR source port or fwrule in Firewall and Security Management

PBR source port or fwrule

Arthur_DENIS1 — Fri, 03 Feb 2023 15:36:06 GMT

Hi,

I try to setup a PBR rule - but i'm currently stuck...

Is it possible to use PBR rule matching source port instead of destination port ?

Or, second question - how can we use the match on fwrule ?

0> set pbr rule priority 300 match fwrule
Configures the 'firewall rule' match condition for a
Policy Based Routing (PBR) rule.

Value: Specify which firewall rule to match by
entering the rule number or rule name, as
it appears in SmartConsole

The firewall rule must be configured through SmartConsole
first before you can use it here. When creating the rule
in SmartConsole, it must begin with the prefix 'PBR_'
followed by the rule name.

Example: PBR_SSH, PBR_Telnet

0> set pbr rule priority 300 match fwrule PBR_test
RTGRTG0001 FW rule ID does not exist.
set pbr rule priority 300 match fwrule PBR_test
--------------------------------^^^^^^^^^^^^^^^

Thanks !

Re: PBR source port or fwrule

Wolfgang — Fri, 03 Feb 2023 16:02:46 GMT

@Arthur_DENIS1 How to use firewall rules for application based PBR Policy-Based Routing and Application-Based Routing in Gaia

Use of firewall rules for PBR will be used for ABR (Application Based Routing). PBR for source port is not supported.
Please explain what do you want, maybe ther‘s another solution.

Re: PBR source port or fwrule

Arthur_DENIS1 — Fri, 03 Feb 2023 16:31:11 GMT

Hi @Wolfgang

Thanks for the answer.
What if I use a firewall rule containing service restricted to a source port ? Can work or not ?

Source port should be possible, based on sk100500 - "The following features are not supported by PBR by default, and are available only as a Request for Enhancement (RFE) via Check Point local office: PBR with Source Port routing"
So I assume that it as already implemented for somes customers 🙂

Please find attached a draft of the target design.
The need: be able to initiate opnvpn from IP public 1 and/or 2 in the same time. I do not find other way to do that without PBR...
Any ideas are welcome !

Re: PBR source port or fwrule

PhoneBoy — Fri, 03 Feb 2023 19:33:26 GMT

The functionality of PBR based on Source Port requires a specific software release, most likely.
Your local Check Point office should be able to get the details of this.