topic Re: Which Check Point HA model will support Alias Interface? in Firewall and Security Management

Which Check Point HA model will support Alias Interface?

MarcuzShinz — Tue, 13 Aug 2024 09:50:17 GMT

Hi Guy!

I have some questions and hope everyone can help. As far as I know Check Point Cluster will not support Alias Interface. So is there any other HA model that supports this type of interface?

Re: Which Check Point HA model will support Alias Interface?

emmap — Tue, 13 Aug 2024 10:00:59 GMT

I don't think any of them well, what's the use case?

Re: Which Check Point HA model will support Alias Interface?

MarcuzShinz — Tue, 13 Aug 2024 10:04:59 GMT

We have multiple public IPs configured on the same interface, as you can understand similar to Fortigate it is the same secondary IP. On the Check Point it will be the Alias interface, currently I am using Gateway with Standalone mode, so I can configure Alias Interface, however, I want the system to be redundant. We need a Check Point HA model that supports Alias Interface.

I'm thinking about VRRP but don't know how it would work, and also if it supports alias interface?

Re: Which Check Point HA model will support Alias Interface?

_Val_ — Tue, 13 Aug 2024 10:18:26 GMT

You cannot run a Full HA cluster in VRRP, it has to be ClusterXL, AFAIK.

Re: Which Check Point HA model will support Alias Interface?

Alex- — Tue, 13 Aug 2024 10:21:02 GMT

If I understand correctly, you want more than one public IP to answer on your public interface.

In this case, you could use Proxy ARP to have the public interface respond to these IP's.

Re: Which Check Point HA model will support Alias Interface?

PhoneBoy — Tue, 13 Aug 2024 16:02:25 GMT

What is the precise use case for these alias IP addresses?
If it's for a device behind the gateway, you can create automatic NAT rules to make those IPs available.
If you are doing manual NAT rules, you'll need to create proxy ARPs for the relevant IP.

If this is not your use case, please provide details.

Re: Which Check Point HA model will support Alias Interface?

MarcuzShinz — Fri, 23 Aug 2024 02:25:44 GMT

Dear PhoneBoy,

Let me explain the issue in detail below:

1. The first, we have configured interface as image below:

2. I have some internal servers inside and configured with static NAT pointing out at these IPs.

The Arp Proxy you suggested only supports "The procedure below is for Source Manual NAT only (Destination Manual NAT is currently not supported)". I need both.

Re: Which Check Point HA model will support Alias Interface?

MarcuzShinz — Fri, 23 Aug 2024 02:26:02 GMT

Sory

Re: Which Check Point HA model will support Alias Interface?

Chris_Atkinson — Mon, 19 Aug 2024 08:53:06 GMT

Routing, NAT pools or Proxy-ARP are the common tools available to assist here.

Regarding Alias IP support please refer: https://support.checkpoint.com/results/sk/sk89980

Re: Which Check Point HA model will support Alias Interface?

PhoneBoy — Mon, 19 Aug 2024 16:39:25 GMT

None of the items under "Range IP Alias" should require Alias IPs on the gateway.
A regular Proxy Arp should suffice here and should work where the destination IP requires NAT.

topic Re: Which Check Point HA model will support Alias ​​Interface? in Firewall and Security Management

Which Check Point HA model will support Alias ​​Interface?

Re: Which Check Point HA model will support Alias ​​Interface?

Re: Which Check Point HA model will support Alias ​​Interface?

Re: Which Check Point HA model will support Alias ​​Interface?

Re: Which Check Point HA model will support Alias ​​Interface?

Re: Which Check Point HA model will support Alias ​​Interface?

Re: Which Check Point HA model will support Alias ​​Interface?

Re: Which Check Point HA model will support Alias ​​Interface?

Re: Which Check Point HA model will support Alias ​​Interface?

Re: Which Check Point HA model will support Alias ​​Interface?

topic Re: Which Check Point HA model will support Alias Interface? in Firewall and Security Management

Which Check Point HA model will support Alias Interface?

Re: Which Check Point HA model will support Alias Interface?

Re: Which Check Point HA model will support Alias Interface?

Re: Which Check Point HA model will support Alias Interface?

Re: Which Check Point HA model will support Alias Interface?

Re: Which Check Point HA model will support Alias Interface?

Re: Which Check Point HA model will support Alias Interface?

Re: Which Check Point HA model will support Alias Interface?

Re: Which Check Point HA model will support Alias Interface?

Re: Which Check Point HA model will support Alias Interface?