topic Re: BGP sessions under the same VLAN in Firewall and Security Management

BGP sessions under the same VLAN

jesussantiago01 — Sat, 16 Aug 2025 03:35:03 GMT

Currently, a Checkpoint firewall is being managed in which I have a VLAN to Azure. Currently, I want the Checkpoint gateway devices to receive two BGP sessions under the same VLAN ID. Would this be possible? Thank you for your help.

BGP sessions under the same VLAN

soc_fenix — Sat, 16 Aug 2025 03:29:08 GMT

Thank you for your help.

Re: BGP sessions under the same VLAN

Chris_Atkinson — Sat, 16 Aug 2025 04:18:42 GMT

For peers on different subnets correct, is this a cluster?

Other scenarios where this has been achieved VLAN mapping or VLAN translation is used on the intermediate switch.

Re: BGP sessions under the same VLAN

Chris_Atkinson — Mon, 18 Aug 2025 10:43:22 GMT

I have merged your thread with this existing one.

Re: BGP sessions under the same VLAN

jesussantiago01 — Mon, 18 Aug 2025 18:42:38 GMT

Yes, that is correct. Both BGP peers are on different /30 subnets, but they are delivered over the same VLAN ID by Azure ExpressRoute.

And yes, this is a Check Point cluster (ClusterXL in HA mode). The challenge is that Azure provides two separate /30 peerings on a single VLAN, while Check Point does not seem to support configuring multiple IP networks on the same VLAN interface in a cluster.

Can you please confirm if there is any supported method on Check Point to handle this scenario, or if the only option is to implement VLAN mapping/translation on the intermediate switch to separate each /30 into different VLANs before reaching the firewalls?

Re: BGP sessions under the same VLAN

PhoneBoy — Mon, 18 Aug 2025 20:47:16 GMT

This is a long-standing limitation of ClusterXL: https://support.checkpoint.com/results/sk/sk31821
Which means you'll have to translate the VLANs somehow.