topic Re: R81.10 static protocol-rank support in Firewall and Security Management

R81.10 static protocol-rank support

User-CP — Wed, 21 Jun 2023 09:33:21 GMT

Dear Check Point Community

My customer using security gateway 7000 running R81.10. they have multiple route to the same IP destination(static and OSPF). they want to priorities to static route by define rank to 5 and keep OSPF as default 10. well known best route chosen refer to lowest rank. actualy active route on ospf.

does the R81.10 support static protocol-rank?

Noted: the output of show protocol-rank

Protocol Rank

----------------

kernel 10

ospf 10

bgp 20

ip 30

thank

Re: R81.10 static protocol-rank support

Chris_Atkinson — Wed, 21 Jun 2023 12:27:33 GMT

All static routes or specific ones?

The set static-route CLISH command provides a "rank" parameter.

Refer:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/IPv4-Static-Routes-Gaia-Clish.htm

https://sc1.checkpoint.com/documents/r81.10/webadminguides/en/cp_r81.10_gaia_advanced_routing_adminguide/topics-garg/routing-options-protocol-rank.htm

Re: R81.10 static protocol-rank support

User-CP — Thu, 22 Jun 2023 02:10:46 GMT

hello Chis_atkinson

thank you for your response,

In this scenario, I try to define the static route over OSPF with the best route by set protocol-rank for static route to lower then ospf.

Important: for static route destination IP with slash /27 and ospf with slash /30.

it's the check point route algorithm prefer prefect then protocol rank?

Thank

Re: R81.10 static protocol-rank support

Chris_Atkinson — Thu, 22 Jun 2023 02:41:35 GMT

If the OSPF routes are more specific then rank won't come into the equation.

Re: R81.10 static protocol-rank support

JozkoMrkvicka — Thu, 22 Jun 2023 05:46:11 GMT

you have to have 2 exactly same networks with the same netmask in order to match the rank settings.

If you have static route 10.0.0.0/24 with rank 1 and OSPF route 10.0.0.0/25 with rank 400, then traffic going to IP 10.0.0.20 chose OSPF because it is more specific. In this case rank doesnt play a role.