topic Re: Rank and Cost in Check Point in General Topics

Rank and Cost in Check Point

Hllrdm — Tue, 18 Apr 2023 06:35:14 GMT

I want to figure out the rank-to-cost ratio in Check Point routing.
We can adjust Rank between static routes, dynamic protocols, but we don't see a cost adjustment for routes. We know that rank and cost affect the order in which packets are sent through the routing table.We tried to set the same rank between the static route and the rank that comes in via ospf. In this case traffic went via ospf route, cost of ospf was lower than that of static route.
When we output show route, we see cost, but we don't see rank. How do these concepts relate to Check Point?

Re: Rank and Cost in Check Point

_Val_ — Tue, 18 Apr 2023 06:36:59 GMT

Please provide a specific example.

Re: Rank and Cost in Check Point

Hllrdm — Tue, 18 Apr 2023 06:47:47 GMT

We are preparing an example. Maybe you can tell us how cost and rank are related in Check Point?

Re: Rank and Cost in Check Point

_Val_ — Tue, 18 Apr 2023 06:56:39 GMT

Nothing special with Check Point. Lower cost should be the preferable route. Not sure what you mean by "rank" though.

Please also refer to the advanced routing guide for your version, for example: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityGateway_Guide/Content/Topics-FWG/Advanced-Routing.htm

Re: Rank and Cost in Check Point

Chris_Atkinson — Tue, 18 Apr 2023 08:53:11 GMT

The "Protocol Rank" concept is described here:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Gaia_Advanced_Routing_AdminGuide/Content/Topics-GARG/Routing-Options-Protocol-Rank.htm

Re: Rank and Cost in Check Point

MiniNinja — Wed, 19 Feb 2025 13:12:51 GMT

And what about the priority in relation to Ipsec VPN domain, what is the priority of networks (routes) in the VPN domain?

Re: Rank and Cost in Check Point

PhoneBoy — Wed, 19 Feb 2025 16:01:40 GMT

Domain-Based VPN traffic (as opposed to Route/Based VPN with VTIs) always takes priority over other routes due to VPN’s position in the kernel.

Re: Rank and Cost in Check Point

MiniNinja — Thu, 20 Feb 2025 12:06:40 GMT

which is more priority than a static route or a VPN domain?

Re: Rank and Cost in Check Point

PhoneBoy — Thu, 20 Feb 2025 13:25:34 GMT

Pretty sure a VPN Domain has higher priority.

Re: Rank and Cost in Check Point

the_rock — Thu, 20 Feb 2025 14:45:35 GMT

I always thought domain based tunnel has priority over route based one, but then static route would have precedence over VPN domain.

Andy