topic Re: Outbound Traffic from Standby Member in Firewall and Security Management

Outbound Traffic from Standby Member

stallwoodj — Mon, 24 Jul 2023 12:35:27 GMT

Hi,

On R81.20 cluster, outbound ICMP and TCP traffic from secondary member is shown with "fw monitor" to be going out the primary Active member (as below).

As I'm trying to troubleshoot a physical link, please could you remind me what settings in Global / GuiDB / def I need to configure these days to always source outbound (internet) traffic from the local gateway?

Thanks

Jamie

[vs_0][ppak_0] eth3:i[44]: aa.bb.cc.158 -> dd.ee.ff.12 (ICMP) len=84 id=21637
ICMP: type=8 code=0 echo request id=31027 seq=1
[vs_0][fw_0] eth3:i[44]: aa.bb.cc.158 -> dd.ee.ff.12 (ICMP) len=84 id=21637
ICMP: type=8 code=0 echo request id=31027 seq=1
[vs_0][fw_0] eth3:I[44]: aa.bb.cc.158 -> dd.ee.ff.12 (ICMP) len=84 id=21637
ICMP: type=8 code=0 echo request id=31027 seq=1
[vs_0][fw_0] eth0:o[44]: aa.bb.cc.158 -> dd.ee.ff.12 (ICMP) len=84 id=21637
ICMP: type=8 code=0 echo request id=31027 seq=1
[vs_0][fw_0] eth0:O[44]: aa.bb.cc.156 -> dd.ee.ff.12 (ICMP) len=84 id=21637
ICMP: type=8 code=0 echo request id=11459 seq=1

Re: Outbound Traffic from Standby Member

PhoneBoy — Mon, 24 Jul 2023 13:37:55 GMT

https://support.checkpoint.com/results/sk/sk34180

Re: Outbound Traffic from Standby Member

stallwoodj — Mon, 24 Jul 2023 14:00:04 GMT

Thanks Dameon! I couldn't work out the right question to search for in Support Center 🙂

However, the packets are still egressing the Active member through PerfomancePak connectivity, so I'm still having trouble testing the Standby's physical interface.

Cheers

Jamie

Re: Outbound Traffic from Standby Member

Adam276 — Mon, 24 Jul 2023 19:58:33 GMT

I found this. It doesn't mention anything about it not applying anymore...

"Changing the value of "perform_cluster_hide_fold" field does not change the ClusterXL behavior"
https://support.checkpoint.com/results/sk/sk154272

Re: Outbound Traffic from Standby Member

stallwoodj — Tue, 25 Jul 2023 13:44:45 GMT

Thanks,

The value stops the NAT but doesn't prevent the traffic from egressing via the active firewall!

Re: Outbound Traffic from Standby Member

the_rock — Tue, 25 Jul 2023 13:54:30 GMT

That sk says there is some sort of fix for that...