topic Re: Check Point R77.30 ClusterXL and Cisco GLBP? in Firewall and Security Management

Check Point R77.30 ClusterXL and Cisco GLBP?

Dave_Cullen — Thu, 25 Oct 2018 11:52:47 GMT

Is anyone using Check Point R77.30 ClusterXL and Cisco GLBP? Our MPLS provider has configured gateway load balancing protocol between two 50Mbit circuits. We are using the VIP of these routers as our route for the MPLS network. We were told that they are seeing traffic only being utilised outbound on one circuit. I've read this post which describes my scenario pretty much, however there isn't a solution, has anyone else come across this?

Any help appreciated!

(I cross posted this in to "Check Point Experts" on linked in - Apologies)

Re: Check Point R77.30 ClusterXL and Cisco GLBP?

PhoneBoy — Thu, 25 Oct 2018 17:05:21 GMT

How many routes are configured for this destination on the Check Point devices?

Re: Check Point R77.30 ClusterXL and Cisco GLBP?

Dave_Cullen — Thu, 25 Oct 2018 17:36:20 GMT

Just one route. All global sites have their own /29 transfer network within the /24 super net.

Re: Check Point R77.30 ClusterXL and Cisco GLBP?

PhoneBoy — Thu, 25 Oct 2018 20:15:33 GMT

I would assume the forwarding decision is "upstream" then and not something the Check Point can directly influence.

Is the traffic going to the MPLS circuit subject to NAT?

Re: Check Point R77.30 ClusterXL and Cisco GLBP?

Dave_Cullen — Thu, 25 Oct 2018 20:31:38 GMT

In my experience HSRP and VRRP all uses a VIP and all the "magic" is handled upstream yes.

The service provider engineer told me that the MAC address is alternated for the VIP that is provided by the GLBP cluster and this is how the load balancing is performed.

I guess the difference here is that we have active / active.

His last comments were:

Your device should be capable to do Load-Sharing and accept two MACs for one IP, please check this.

Some ideas:

Please allow asymmetric flows on your Firewall
Please register two MAC addresses for The VIP IP X.X.X.1 (MAC: 00:00:00:00:00:01 and 00:00:00:00:00:02) on you Firewall (Example Addresses)

I replied with:

I cannot see that this is possible in Check Point
I cannot create two static ARP entries for the same MAC - Gaia simply overtires the original entry when adding the second one

Maybe someone has specific experience in this scenario and could correct my logic above?

Thanks so far!

Re: Check Point R77.30 ClusterXL and Cisco GLBP?

PhoneBoy — Thu, 25 Oct 2018 21:02:27 GMT

I'm not sure how allowing asymmetric flows would necessarily solve this since the problem appears to be the fact we're sending traffic to one of the two MAC addresses.

Even so, asymmetric flows are bad from a firewall perspective.

You may be able to use ECMP (Equal Cost Multipath) to your advantage here.

Configure a static ARP with some other IP on that subnet as a second route.

Configure the "real" IP and this other IP as nexthops using ECMP.