topic Re: Static route in VSX in Firewall and Security Management

Static route in VSX

Ihenock1011 — Thu, 12 Dec 2024 06:37:36 GMT

Hi Everyone,

We have a Checkpoint R81.10 security gateway in a VSX environment. I'm trying to configure the following routes:

• Source: 172.16.1.0/24
o Destination: 10.1.1.1/32
o Gateway: VPN tunnel

• Source: 172.16.1.0/24
o Destination: 0.0.0.0
o Gateway: external interface

However, the VSX route configuration seems to only allow specifying the destination IP, not the source IP. Is there a way to achieve this configuration?

Re: Static route in VSX

Alex- — Thu, 12 Dec 2024 08:29:35 GMT

PBR requires a Virtual Router as per sk79700.

Re: Static route in VSX

Chris_Atkinson — Thu, 12 Dec 2024 08:59:38 GMT

PBR should be possible on a VS since R80.40 per sk167135

Re: Static route in VSX

Wolfgang — Thu, 12 Dec 2024 09:11:08 GMT

No, there is no more a requirement for a virtual router if you want to use PBR. You can use normal PBR rules.

With VSX some limitations for PBR exists.... see sk167135 - Policy-Based Routing and Application-Based Routing in Gaia mentioned by @Chris_Atkinson

You can configure PBR in Gaia Clish.
You can configure only Source IP, Destination IP, and the Interface.
You cannot configure additional parameters (destination service port and protocol).

Re: Static route in VSX

Alex- — Thu, 12 Dec 2024 09:48:39 GMT

OK, thanks for the clarification. I looked at the VSX SK, not the PBR. 😀

Re: Static route in VSX

Ihenock1011 — Mon, 16 Dec 2024 08:11:55 GMT

We already configure PBR as per below yet when the partner tries to reach to our endpoint it hits the external interface.

set pbr rule priority 01 match from 172.16.1.0/24
set pbr rule priority 01 match to 10.1.1.1/32
set pbr rule priority 01 action table VPN tunnel

FYI

Partner IP: 172.16.1.0/24

Our Endpoint: 10.1.1.1/32