topic Re: ISP redundancy in Firewall and Security Management

ISP redundancy

the_rock — Wed, 14 Oct 2020 15:07:27 GMT

Hi everyone,

I had some questions about ISP redundancy in R80. I know its not that different than previous versions, but its been awhile since I troubleshot it and was wondering if someone could confirm below.

I have a customer with single R80.30 gateway managed by R80.30 mgmt server and they just set up 2nd ISP link, so they are wanting to implement isp redundancy. BEFORE enabling it in dashboard, can someone answer the following:

-what routing changes would need to be made?

-what about policy routing?

-do any dns changes have to be done via cli or web GUI?

-how would client to site and site to site vpn work when primary isp link fails? Any changes have to be done on the tunnels prior to enabling isp redundancy?

-would it affect any gateways with 3rd party certificates?

Also, I did not really find any good isp redundancy document, aprt paragraph from R80.40 admin guide.

Thanks in advance!

Andy

Re: ISP redundancy

Wolfgang — Thu, 15 Oct 2020 06:30:56 GMT

@the_rock

-what routing changes would need to be made?

Normally nothing, the routing configuration via two default gateways (your ISPs) will be done via SmartConsole.

-what about policy routing?

PBR with ISP redundancy is supported starting from R80.30.

-do any dns changes have to be done via cli or web GUI?

You can rewrite DNS-requests, configuration will be done via SmartConsole (DNS-proxy)

-how would client to site and site to site vpn work when primary isp link fails? Any changes have to be done on the tunnels prior to enabling isp redundancy?

You can use both ISP links for your VPN, in load sharing or HA mode. Settings for these VPN connections are configured via VPN link selection.

-would it affect any gateways with 3rd party certificates?

Can you explain this to understand your needs.

Good documentation will be the old one for R77.30 to understand the concept and configuration

HOW TO CONFIGURE ISP REDUNDANCY IN NGX R65 - R77.30 VERSIONS

and these sk

ISP Redundancy configuration

Advanced configuration options for ISP Redundancy

Wolfgang

Re: ISP redundancy

the_rock — Thu, 15 Oct 2020 12:34:51 GMT

Thanks a lot for that Wolfgang, appreciated. Just to clarify some poinhts I made (sorry for not being more clear about them). Below are actual questions customer asked me:

-What has to be done in configuration to ensure IPSEC Office Mode Tunnels and the SSL VPN Mobile client will work on both interfaces?

-What additional DNS configuration needs to be done in the Checkpoint Redundancy configuration to ensure the firewall resolves the interfaces with no issue.

-a capture of any other configurations that we have not yet discussed above that need to be changed.

I know for VPN, there is a setting under isp redundancy page in dashboard to "apply settings to vpn", which I read would mean it overrides existing link selection settings, but I believe thats what most customers would want anyway, specially in case like this, where main link is fiber 1 GB connection and backup is only 20 MB. For dns, I dont think they need to change actual dns servers. but the dns proxy setting says its if you have servers that are accepting incoming connections, then needs to be configured.

Dont worry about my certificate question, as Im sure that does not apply to ips redundancy. He was more asking me that if they use 3rd party cert for mobile access or https inspection if that would be affected, but Im pretty sure it would not be.

Also, for policy based routing, I do see in my lab it gives you options to set up the routes, but based on priorities and interfaces, NOT actual isp link, but corretc me if Im wrong, you can simply choose interface corresponding to the isp link to reflect that route, correct?

Again, thanks for the response!

Andy

Re: ISP redundancy

Wolfgang — Tue, 20 Oct 2020 07:08:50 GMT

@the_rock

default configuration in ISP redundancy is HA-mode. One ISP is active and the other in standby. All connections (include site2site and remote access VPN) are sent and received via the active ISP. ISP Redundancy "Apply settings for VPN traffic" is not working with 3rd party vendors shows a good example what means the setting "apply to vpn ...."

Rewriting DNS will be necessary only if you have internal servers they are reachable via external DNS-names. If your main ISP link is failing these DNS names are pointing to not reachable IP-addresses. This has to be changed to addresses for your backup ISP.

IPSEC-Tunnel beetween CheckPoint gateways are no problem with ISP redundancy. They do RDP-probing ( Check Points own probing protocol) to test connectivity to all available interfaces. In HA configuration the active ISP is used first. Same apply to remote access VPN clients.

Policy based routing and ISP-redundancy does not work together. Meaning you can use both together but they don't interact. Configure host probing for your PBR routes to check the availability of the ISP-links.

Wolfgang

Re: ISP redundancy

the_rock — Tue, 20 Oct 2020 10:29:50 GMT

Hi Wolfgang,

Thanks, but Im still confused about your last point. You said isp redundancy is supported with policy based routing in R80.30, but in sk about pbr on support site it says it not. Which is true??

Andy

Re: ISP redundancy

the_rock — Tue, 20 Oct 2020 13:41:49 GMT

Also, not sure what host probing you are referring to for PBR...can you elaborate?

Re: ISP redundancy

Wolfgang — Tue, 20 Oct 2020 15:26:13 GMT

@the_rock

you an configure a host to be "monitored" via ping. You should configure two IPs, each one from one of the ISPs.

And then these IPs can be used to be monitored in your PBR configuration. You have to configure two routes with different priorities.

If a monitored host answeres the ping, this route will be active and used regarding the configured priority. If your primary ISP will fail, the ping test to the monitored host fails too and the second route entry will be used.

Hope, this makes the PBR with more then one ISP understandable.

Wolfgang

PS: snip from the what's new section R80.30

Re: ISP redundancy

the_rock — Tue, 20 Oct 2020 15:34:37 GMT

thanks!

Re: ISP redundancy

Eduardo_Eiros — Tue, 20 Oct 2020 17:04:19 GMT

Hello Wolfgang

Can you explain more "PBR with ISP redundancy is supported starting from R80.30."

Because in the sk https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk100500&partition=Basic&product=Security

is not supported. And in my tests it did not work (nat hide was not applied correctly for PBR routed connections...)

Thanks

Re: ISP redundancy

the_rock — Tue, 20 Oct 2020 17:37:05 GMT

Good point Eduardo...I was wondering that exact same thing as well.

Re: ISP redundancy

Wolfgang — Tue, 20 Oct 2020 17:52:30 GMT

@Eduardo_Eiros

Please check your NAT rules. You have to use an automatic NAT rule with „hide behind gateway“ enabled.

Wolfgang

Re: ISP redundancy

Wolfgang — Tue, 20 Oct 2020 18:58:30 GMT

Tagging @PhoneBoy to get some clarification.

Policy-Based Routing (PBR) on Gaia OS shows ISP redundancy not supported with PBR, up to R80.40.

From R80.30 what’s new “Multihop Ping and Multiple ISPs in Policy-Based Routing“ will be supported. Does this indicate ISP redundancy is supported ?

From a technical view it‘s working, but is it supported ?

Wolfgang

Re: ISP redundancy

Eduardo_Eiros — Tue, 20 Oct 2020 19:47:37 GMT

Hello

Yes, NAT rules were checked, and worked if ISP redundancy was off.

Well Wolfgang, probably you will get somekind of ISP redundancy with PBR and using “Multihop Ping and Multiple ISPs in Policy-Based Routing“, but if you enable ISP redundancy in the gw the nat rules will not work . Take a looh ar https://community.checkpoint.com/t5/General-Topics/ISP-Redundancy-with-PBR/m-p/67783

Regards

Re: ISP redundancy

PhoneBoy — Wed, 21 Oct 2020 00:57:09 GMT

ISP Redundancy and PBR are mutually exclusive features at the moment.