topic Re: PBR limitation with ISP redundancy on is still there? in Firewall and Security Management

PBR limitation with ISP redundancy on is still there?

Blason_R — Fri, 26 May 2023 02:37:41 GMT

Hey Guys,

I still remember there was a limitation in earlier version when ISP redundancy is enabled on firewall modules PBRs (Policy based Routing) configured does not work as ISP redundancy does take precedence.

Yesterday I was working on one of the scenario and I configured PBR with ISP redundancy on and its worked as expected. Then I tried searching if that limitation is removed and did not find any such concrete answer hence keen to know any official answer?

TIA

Blason R

Re: PBR limitation with ISP redundancy on is still there?

PhoneBoy — Fri, 26 May 2023 02:49:01 GMT

PBR and ISP Redundancy perform similar functions and are not supported together.
It is documented here: https://support.checkpoint.com/results/sk/sk167135

Re: PBR limitation with ISP redundancy on is still there?

the_rock — Fri, 26 May 2023 03:19:28 GMT

It does work 100%, had customer do it and was fine. But, as phoneboy said, officially, its NOT supported.

Andy

Re: PBR limitation with ISP redundancy on is still there?

Blason_R — Fri, 26 May 2023 03:24:27 GMT

Yes - I knew that it does not work together and it wasn't when I had implemented (or tried implementing)couple of times before. However yesterday same thing I decided to try with R81.10 and woahh it worked not sure why!!

Re: PBR limitation with ISP redundancy on is still there?

the_rock — Fri, 26 May 2023 03:26:21 GMT

I never tested it in R81 base, but it works fine in R81.10 and R81.20. But again, since its not officially supported by the vendor, its one of those situations that if it breaks,you are sort of on your own (aka SOL lol)

Re: PBR limitation with ISP redundancy on is still there?

PhoneBoy — Fri, 26 May 2023 13:19:56 GMT

Just because something isn’t supported doesn’t mean it won’t work. 😉
Having said that, relying on unsupported feature combinations in production is unwise.

Re: PBR limitation with ISP redundancy on is still there?

the_rock — Fri, 26 May 2023 13:26:07 GMT

Thats true, but lets be 100% honest...we all know that TAC will tell people right away if something is not officially supported, even if it works. Having said that, I dont blame them, all vendors' support would do that : - )

Re: PBR limitation with ISP redundancy on is still there?

RS_Daniel — Fri, 26 May 2023 15:38:11 GMT

Hello,

I also used PBR's on a ISP redundancy scenario, when we configured the PBR's it worked ok but when we changed an existing rule, let's say pbr rule 15, the previous one was not deleted, so checking with ip rule command we had duplicated rule 15, and the new one didn't start working until i deleted manually the old rule 15 with ip rule del command.

So in my experience it works but not very well and as @PhoneBoy and @the_rock told you, not recommended to have an unsupported feature working on production.

Regards

Re: PBR limitation with ISP redundancy on is still there?

the_rock — Fri, 26 May 2023 15:40:04 GMT

Agree 100%. I dont know, MAYBE if Diamond customer wanted to do this, would be okay, considering how much money those customers pay, otherwise, I doubt it lol