topic VPN Link Selection - Question in Firewall and Security Management

VPN Link Selection - Question

FWNinja — Thu, 12 Sep 2019 14:22:59 GMT

Hi all,

I have other question for you.

I have configured VPN link selection with "Outgoing Route Selection -> When initiating a tunnel -> Operating system routing table".

"Operating system routing table" conteins PBR route? Or PBR route are in a separeted table?

Thanks and Best regards

Francesco

Re: VPN Link Selection - Question

G_W_Albrecht — Thu, 12 Sep 2019 14:29:00 GMT

Have a good look into this : sk100500: Policy-Based Routing(PBR) on Gaia OS

Re: VPN Link Selection - Question

FWNinja — Thu, 12 Sep 2019 14:32:36 GMT

Thanks for the link.

I already read sk link related to PBR but I cannot find anything relevant about my question.

Best regards

Francesco

Re: VPN Link Selection - Question

PhoneBoy — Thu, 12 Sep 2019 18:07:51 GMT

What is it you're actually trying to accomplish?

Re: VPN Link Selection - Question

FWNinja — Fri, 13 Sep 2019 07:50:23 GMT

Hi,

I'm going to migrate Internet connection to a new ISP External interface.

I will use PBR to migrate subnet per sunbet.

I'd like to know if the OS routing table (in vpn link selection) conteins PBR route.

Thanks and Best Regards

Francesco

Re: VPN Link Selection - Question

FWNinja — Mon, 16 Sep 2019 07:59:07 GMT

Hi,

I will migrate Internet connection using PBR route.

For VPN route in Link Selection section it's configured "Outgoing Route Selection -> When initiating a tunnel -> Operating system routing table".

So, I want to know if Operating system routing table conteins PBR route that I will configure for the Internet connection migration.

Thanks

Francesco

Re: VPN Link Selection - Question

FWNinja — Wed, 18 Sep 2019 08:50:43 GMT

VPN Link Selection does not support PBR route for outbound vpn traffic. Checkpoint confirmed it!

Re: VPN Link Selection - Question

Maarten_Sjouw — Wed, 18 Sep 2019 11:20:50 GMT

VPN selection should use this setting indeed and you should set static routes for the remote sites that you have migrated to the new IP.
PBR has nothing to do with setting up the VPN, the traffic will not actually use the PBR as the traffic is not related to the VPN IPs themselves.

Re: VPN Link Selection - Question

FedericoMeiners — Wed, 18 Sep 2019 13:43:13 GMT

@Maarten_Sjouw It's important to note that PBR takes precedence before static routes, I have many customers with PBR intensive gateways that usually route by source causing VPN routing chaos.