topic Re: Checkpoint Firewall 5K Series with Cisco Core switch With HSRP in General Topics

Checkpoint Firewall 5K Series with Cisco Core switch With HSRP

Harmesh_Yadav — Mon, 21 Dec 2020 08:12:50 GMT

Dear Team ,

we have requirement like below please confirm and let us know if any limitation with this .

We have Two Chcekpoint Devices which is 5100 Series device and Cisco L2 switch for WAN and Cisco 9500 for Core Switch

Presently Both Checkpoint In One location - in proposed solution each checkpoint we be at each building .

2 Dedicated switch for ISP Connectivity at each Building

Go through Diagram it wil give your better visibility (yellow wil be fiber)

Both Location connectivity we will do over Fiber cable

Find attached Diagram Which we have created .

I have doubt about compatibility with Checkpoint and Cisco -- HSRP --- is it possible in this scenario or we should run VRRP - and what changes required and what precautions we need to take .

Your suggestion will be very important for me to run this environment with smooth way

Thanks in advance

Re: Checkpoint Firewall 5K Series with Cisco Core switch With HSRP

_Val_ — Mon, 21 Dec 2020 08:59:11 GMT

Should not be an issue.

Re: Checkpoint Firewall 5K Series with Cisco Core switch With HSRP

Harmesh_Yadav — Mon, 21 Dec 2020 11:43:23 GMT

is there any limitation in this scenario?

Re: Checkpoint Firewall 5K Series with Cisco Core switch With HSRP

Magnus-Holmberg — Mon, 21 Dec 2020 12:37:05 GMT

If you want to run 2 ISP and as am guessing its the ISP CPE and not your own boxes.

Then you would need to run linknetworks with BGP between your check point boxes and the ISP CPE.
You would also need your own AS number and PI addresses.

I would recommend to use one /29 linknetwork for each provider so you can add both your check point boxes and use cluster xl.
Then you would route your PI addresses instead so you dont need to mess with local.arp and such things.

The inside with HSRP/VRRP dosn´t matter both will work.
With Cisco 9500 most ppl i guess would run stackwise virtual, issue with that is that is that you requires alot of fiber between your buildings.
Same as your suggested design alot of fibers are needed,

Personally i would build it like this, more or less to save fiber between the buildings if you need to add more unitis suchs as WLC, ISE servers etc.
This way you also dont need to have STP within the network.

Regards,
Magnus

Re: Checkpoint Firewall 5K Series with Cisco Core switch With HSRP

Harmesh_Yadav — Mon, 21 Dec 2020 13:20:14 GMT

Thank you for your reply -- really appreciate your help