topic Re: PBR With Multiple Tracking in General Topics

PBR With Multiple Tracking

Jesus_Vladimir_ — Mon, 27 Nov 2017 15:31:02 GMT

Hi, how to configure PBR for redundancy automatic,i try Priority but not functioning.

Regards

Re: PBR With Multiple Tracking

PhoneBoy — Tue, 28 Nov 2017 07:11:57 GMT

A network diagram of what you're trying to do would be helpful.

Re: PBR With Multiple Tracking

Marco_Valenti — Tue, 28 Nov 2017 10:53:21 GMT

if you want to use two external connectivity and have an automatic backup if you loose one of them ( if I understand correctly) probably you need to implement ISP redundancy , policy base routing wont work in that way

Re: PBR With Multiple Tracking

Jesus_Vladimir_ — Tue, 28 Nov 2017 15:06:14 GMT

this is the diagram.

User A connect to internet to ISP A

User B connect to internet to ISP B

User C connect to internet to ISP C

When ISP A is down automatic failover to ISP B or ISP C configured with priority is not functioning.

Re: PBR With Multiple Tracking

PhoneBoy — Tue, 28 Nov 2017 16:26:52 GMT

How would the gateway determine ISP A is down?

To do that, you'd need to have a reachability test (such as Ping)--something our PBR doesn't currently support.

Re: PBR With Multiple Tracking

Jesus_Vladimir_ — Tue, 28 Nov 2017 16:52:24 GMT

yes i understand, there is developed for coming soon pbr support this ?

Re: PBR With Multiple Tracking

Timothy_Hall — Tue, 28 Nov 2017 23:53:48 GMT

A little-known feature of ClusterXL may be able to help here; ClusterXL can be configured to test connectivity to upstream IP addresses with ping, and initiate a failover based on loss of reachability to the pinged hosts. There could be a very different Gaia PBR configuration on the standby member that takes over as a result. See:

sk35780: How to configure $FWDIR/bin/clusterXL_monitor_ips script to run automatically on Gaia / SecurePlatform OS

Re: PBR With Multiple Tracking

Vladimir — Wed, 29 Nov 2017 21:02:43 GMT

Tim,

According to sk100500:

PBR is supported in the following clusters:

ClusterXL High Availability
ClusterXL Load Sharing Unicast
ClusterXL Load Sharing Multicast
VRRP

Note:
PBR must be configured on each of the cluster members individually, and the configuration must be identical.

Can you shed some light if the above statement is correct or is it negated by the sk35780?

Re: PBR With Multiple Tracking

Timothy_Hall — Wed, 29 Nov 2017 23:01:04 GMT

I'd say the later SK is probably more correct and the PBR configs should match. I don't think ClusterXL will be able to actually tell if the PBR configuration is different between the cluster members (same way it can't tell if regular IP routing is different between them), but it may cause issues with how connections are represented between the members via state sync. Trying a different PBR config between different cluster members will probably work but will most certainly not be supported.

Re: PBR With Multiple Tracking

PhoneBoy — Sat, 02 Dec 2017 06:22:14 GMT

I believe it's planned, yes, but don't have an exact timeframe.

Re: PBR With Multiple Tracking

Jesus_Vladimir_ — Fri, 06 Jul 2018 21:31:10 GMT

some date estimated for this ?

Re: PBR With Multiple Tracking

PhoneBoy — Sun, 08 Jul 2018 08:43:53 GMT

It appears there is a customer-specific release that offers this functionality.

Please check with your Check Point office.

Re: PBR With Multiple Tracking

Tolchenov_Maksi — Mon, 13 Aug 2018 09:03:33 GMT

Hello! I have the same question! Is there any workaround for now? There past one year since first question..... How to achieve same functionality as on ip sla + track on cisco in PBR?????

Re: PBR With Multiple Tracking

PhoneBoy — Tue, 14 Aug 2018 02:57:12 GMT

Please check with your local office about the customer-specific release I mentioned.

Re: PBR With Multiple Tracking

Jesus_Vladimir_ — Wed, 29 Aug 2018 15:13:50 GMT

i question for the specific release with Check Point Office and respond not exist this.

Regards

Re: PBR With Multiple Tracking

PhoneBoy — Wed, 29 Aug 2018 15:51:46 GMT

Contact me privately with who you're working with.

I'll connect the dots on the backend.

Re: PBR With Multiple Tracking

PhoneBoy — Tue, 03 Sep 2019 23:44:37 GMT

PBR with multiple ISPs is now supported from R80.30.
This is recommended versus using the customer releases previously mentioned.

Re: PBR With Multiple Tracking

quanglnh — Wed, 18 Sep 2019 08:38:36 GMT

Hi PhoneBoy,

I have a situation that need to use tracking host too. Let say from my Check Point Firewall, i have 2 connection to remote site. 1 is primary and 1 is backup. I want to track if primary connection are down (track by ping or something else) all connection to remote site will automaticly change to thê backup connection. And if primary connection up again, then all connections automaticly move back to primary connection. Can we do that with R80.10 or i have to upgrade to R80.30 ?

Re: PBR With Multiple Tracking

FedericoMeiners — Wed, 18 Sep 2019 13:28:08 GMT

@quanglnh You can do this with Multi Hop PBR from 80.30 onwards

Re: PBR With Multiple Tracking

quanglnh — Sun, 22 Sep 2019 16:03:12 GMT

thanks Federico Meiners, I will check on this