topic Re: BGP connection rejection by Check Point 6000 series cluster in Firewall and Security Management

BGP connection rejection by Check Point 6000 series cluster

Arend — Wed, 16 Apr 2025 12:03:53 GMT

Hello,

We have a Check Point 6000 series cluster at R81.20 connected to Cisco hardware of the ISP. We do BGP peering for exchange of default route and some public routes.

After an ISP hardware switch (no config change on our Check Point side) we see a BGP message on port 179 which is send from our Check Point: Notification Message (3), length: 21, Cease (6), subcode Connection Rejected (5)

What would be the issue that the Check Point rejects the connection request? The message was seen on the primary gateway as that gateway is active.

Re: BGP connection rejection by Check Point 6000 series cluster

the_rock — Sat, 19 Apr 2025 12:03:35 GMT

What does zdebug show? fw ctl zdebug + drop | grep "179"

Andy

Re: BGP connection rejection by Check Point 6000 series cluster

Alex- — Sat, 19 Apr 2025 15:15:27 GMT

Check if they didn't implement extra options on the new router, like authentication of the BGP peers and so on.

Re: BGP connection rejection by Check Point 6000 series cluster

the_rock — Sun, 20 Apr 2025 20:42:50 GMT

Good suggestion @Alex-