topic Re: ISP Redundancy and dynamic routing in Firewall and Security Management

ISP Redundancy and dynamic routing

SomAustrianCity — Wed, 30 Apr 2025 11:53:35 GMT

I'm evaluating my current setup for my outgoing traffic (aka internal users accessing the internet).

I noticed that there is a feature called ISP Redundancy, which would allow me to have two uplinks. But i noticed that various documentations say, that i can't use the redundancy when i have dynamic routing protocols in use.

But if i don't use OSPF to learn the default route, would these feature still clash?
For example, if i either only announce routes (eg a default route into the internal network) or learn smaller routes from other devices (eg 192.168.0.0/24 from some router).

These are the mentioned KBs:

R81.20 ClusterXL Administration Guide

Important - ISP Redundancy is not supported if Dynamic Routing is configured (Known Limitation PMTR-68991).

R81.20 ClusterXL AdminGuide

Known Limitations for Scalable Platforms R80.20SP - R81.20 (Maestro Appliances and Chassis)

PMTR-68991 - Scalable Platforms do not support ISP Redundancy if Dynamic Routing is configured (because the ISP Redundancy feature must create a static default route that overrides the default route created by dynamic routing)

sk148074

Thank you.

Re: ISP Redundancy and dynamic routing

the_rock — Wed, 30 Apr 2025 12:11:57 GMT

I could have sworn there was a different sk about this, but they may had integrated into one you mentioned. I know we configured BGP for a client while ago and also enabled ISPR on 6400 model and works fine since 2021, no issues. Its possible was supported back then : - )

Andy

Re: ISP Redundancy and dynamic routing

Lesley — Wed, 30 Apr 2025 15:00:55 GMT

Known Limitation PMTR-68991 not present here for R81.20

https://support.checkpoint.com/results/sk/sk174965

It does show for R81.10

https://support.checkpoint.com/results/sk/sk166717

The R81.20 guide still shows the limitation in the documentation:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityGateway_Guide/Content/Topics-FWG/ISP-Redundancy-on-Security-Gateway.htm

So Check Point either has to change the know limitations page for R81.10 and R81.20 or change the admin guides.

Sorry not able to help further. This needs to be an official statement.