topic Re: ISP Redundancy in Firewall and Security Management

ISP Redundancy

Bernardes — Wed, 24 May 2023 20:29:05 GMT

Hi Mates!

Could you please assist me with some doubts regarding IPS Redundancy?

For instance, when I have two physical interfaces, one for each link, and I want to configure ISP Redundancy in load-sharing mode to utilize both links simultaneously.

How should the outbound NATs be set up?

And in the case of published applications, do I need to create separate inbound NATs for each link?

I consulted the guide and reviewed some SKs, but it wasn't very clear. This is the first time I'm dealing with an environment requiring this setup, so I would greatly appreciate any tips on how to work with ISP Redundancy in the most effective way.

Re: ISP Redundancy

Cyber_Serge — Wed, 24 May 2023 22:01:56 GMT

>And in the case of published applications, do I need to create separate inbound NATs for each link?

according to the documentation below, yes. Because with load sharing you don't know which ISP link the connection is coming to your DMZ servers.

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Quantum_SecurityGateway_Guide/Topics-FWG/ISP-Redundancy-Configuration.htm?TocPath=ISP%20Redundancy%20on%20a%20Security%20Gateway%20%2F%20Security%20Group%7C_____1

Re: ISP Redundancy

the_rock — Wed, 24 May 2023 23:52:56 GMT

Hey again mate,

Yes, @Cyber_Serge is correct. Also, this is super important to remember with ISPR...when you have multiple tunnels configured, other peers would need to know if there is link failure and that sadly, is NOT automatic. Just mentioning this, as lots of people I talked to about it, did not have knowledge of that, so better to be aware in case it happens.

Cheers,

Andy