topic Re: PBR Behavior for Gaia WebUI in General Topics

PBR Behavior for Gaia WebUI

Yeti — Wed, 08 Nov 2023 23:04:51 GMT

Without having a separate VRF for Management traffic I have added PBR rules to facilitate this for the Management interface which is connected to a downstream router that does the L3 routing for Internal networks. It is a simple PBR matching the source IP of the Management interface 10.254.254.61 and the 10.253.253.0/24 destination network where a client would be sourcing Management traffic ( HTTPS,SSH) The action table is also simple where the route back to the 10.253.253.0/24 destination network has next hop gateway IP 10.254.254.1 of the downstream router that the Checkpoint Management interface is connected to ( out-of-band from normal data traffic ). Of course there is a more generic route configured on the firewall for the internal private IP subnets pointing to the downstream router on a separate transit interface. The interesting part is that SSH management traffic gets routed appropriately via the PBR, so traffic ingresses the Management interface and egresses the Management interface. However management Gaia Webui 443 traffic does NOT seem to follow the PBR, instead the traffic ingresses the Management interface and egresses the transit interface with the more generic route. I have verified the traffic flows via fw monitor and disabled/enabled SecureXL just to make sure. The PBR does not define service ports. Any ideas?

R81.10 T110 on 6400 Cluster

Re: PBR Behavior for Gaia WebUI

Chris_Atkinson — Wed, 08 Nov 2023 23:06:09 GMT

"Locally-generated traffic" is a PBR limitation per sk167135.

VSX or MDPS may help achieve the separation that you desire.

Re: PBR Behavior for Gaia WebUI

Yeti — Wed, 08 Nov 2023 23:11:24 GMT

I did review this SK but wasn't sure if this particular scenario is considered as locally generated as the session is sourced outside of the firewall. Any reasons for only SSH working ?

Re: PBR Behavior for Gaia WebUI

Luis_Miguel_Mig — Fri, 15 Dec 2023 11:28:31 GMT

Is there any plan to resolve the Local-generated traffic limitation?

Re: PBR Behavior for Gaia WebUI

PhoneBoy — Fri, 15 Dec 2023 18:55:57 GMT

I recommend approaching your local Check Point office with an RFE if this is needed.