topic Re: Issue with Check Point Load Balancer Traffic Routing in Firewall and Security Management

Issue with Check Point Load Balancer Traffic Routing

RobertZdunek2 — Wed, 04 Dec 2024 11:45:16 GMT

Dear Team,

We recently configured a load balancer using the Check Point Load Balancer to distribute HTTPS traffic between two servers (Server A and Server B) using the round-robin method without session persistence. Based on my observations, the load balancer performs health checks using ICMP.

Due to specific project requirements, we needed to temporarily remove Server B from the load balancer's server group. After removing Server B from the configuration and installing the updated policy, traffic continued to be routed to Server B.

Could you please help clarify why this behavior occurred and advise on any potential misconfigurations or additional steps required to address the issue?

Thank you for your assistance.

Best regards,

Robert Zdunek

Re: Issue with Check Point Load Balancer Traffic Routing

the_rock — Thu, 05 Dec 2024 01:52:18 GMT

Hi Robert,

Can you confirm if that server is currently possibly being used elsewhere in the policy?

Andy

Re: Issue with Check Point Load Balancer Traffic Routing

garrod — Thu, 05 Dec 2024 02:17:07 GMT

I know limited resource in admin guide as well, can try to install database and install policy again to verify?

Re: Issue with Check Point Load Balancer Traffic Routing

RobertZdunek2 — Thu, 05 Dec 2024 07:13:10 GMT

I've done that, but it did not help.

Re: Issue with Check Point Load Balancer Traffic Routing

RobertZdunek2 — Thu, 05 Dec 2024 07:20:31 GMT

Hi the_rock,

Server B object is never used directly in any policy, server group object (containing Server A and Server B) is used in two Load Balancer Objects. Load Balancer object (balancing requests to mentioned server group) that we're talking about is used twice, one for https request and one for communication on other port.

BR,

Robert

Re: Issue with Check Point Load Balancer Traffic Routing

the_rock — Thu, 05 Dec 2024 12:25:35 GMT

Got it. In that case, the only other place I can think of to check would be guidbedit.

Andy

Re: Issue with Check Point Load Balancer Traffic Routing

RobertZdunek2 — Mon, 09 Dec 2024 08:19:06 GMT

Do you know where to look for? Aren't there any magic refresh LB cache command?

BR,

Robert

Re: Issue with Check Point Load Balancer Traffic Routing

D_W — Mon, 09 Dec 2024 15:33:20 GMT

The new policy will only affect new sessions. So you might have to manually kick existing sessions via the "fw ctl conntab -x" command. For syntax see https://support.checkpoint.com/results/sk/sk103876