topic Re: Route outgoing traffic over specific ISP interface in General Topics

Route outgoing traffic over specific ISP interface

IronMan — Sun, 15 Sep 2024 15:37:22 GMT

Hi experts,

I would like to share my issue here, no solution found yet even though it's a basic firewall function.

So i have 2 ISPs with one interface each on my Quantum Spark 1600, let's say ISP1 and ISP2.

I would like to split some of the outgoing traffic coming from the LAN to the internet, as specified websites would be accessed via ISP1 and all other websites via ISP2.

Now, on any other firewall i would create a firewall outbound rule with Name (Access some Websites via ISP1), Source (Any), Destination (microsoft.com, for example), Service/port (Http/https), Action (Allow, NAT or gateway ISP1)

But how to do that on the CP?

Re: Route outgoing traffic over specific ISP interface

AkosBakos — Sun, 15 Sep 2024 18:05:57 GMT

Hi @IronMan

I think URL filtering can be one solution. You create a policy as you mentioned on another FW and will work. But in this scenario the IFs don’t take part in the rule (as by other firewalls). Maybe you can create different NAT rules, eg microsoft would go in ISP1….. will be NATed on the ISP1’s IP

If I understood correct, you want to route the traffic on to ISPs link through depending on the destination (as basic load balancing solution between the 2 links) In this case maybe Policy Based Routing can help, but determinate the destination could be hard.

The seniors will correct me, but there is no out-of-box solution, for load-balancig.

And here is a thread about ISP redundancy

https://community.checkpoint.com/t5/SMB-Gateways-Spark/PBRs-and-ISP-redundancy-on-SMB-appliances/td-p/30111

akos

Re: Route outgoing traffic over specific ISP interface

D_W — Sun, 15 Sep 2024 20:44:39 GMT

Application Based Routing might be what you're looking for. But I do not know if this is possible with SMB Devices (+locally managed).

Re: Route outgoing traffic over specific ISP interface

Chris_Atkinson — Sun, 15 Sep 2024 23:31:32 GMT

Have you attempted to configure the SD-WAN policy / steering objects per your use case?

Re: Route outgoing traffic over specific ISP interface

IronMan — Mon, 16 Sep 2024 06:26:00 GMT

PBR's won't be a solution for me, cause they work on an IP base, and what i need is a hostname base, which can be a bunch of IP's (for example microsoft.com, subdomain1.microsoft.com, subdomain2.microsoft.com would all have different IP's) so it would be a very hard if not impossible task to create PBR's for all of them. In other firewall solution i would just make *microsoft.com/* as a destination. You also specified NAT rules - i didn't find a way to achieve my goal through NAT rules.

Re: Route outgoing traffic over specific ISP interface

IronMan — Mon, 16 Sep 2024 06:26:41 GMT

I will dig into that later, thank you for the hint

Re: Route outgoing traffic over specific ISP interface

IronMan — Mon, 16 Sep 2024 06:28:40 GMT

I heard about this new SD-WAN feature, the thing is it's coming in the latest firmware, but for now we have been told there are some issues with the latest firmware, so we decided to wait a bit for a fixed one.

Re: Route outgoing traffic over specific ISP interface

Chris_Atkinson — Mon, 16 Sep 2024 07:05:23 GMT

For reference it's available both in the current recommended release (R81.10.10) and the latest (R81.10.15)

Re: Route outgoing traffic over specific ISP interface

AkosBakos — Mon, 16 Sep 2024 07:16:40 GMT

Hi @IronMan

True, the SD-WAN is available in R81.10.10.

https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Content/Topics/SD-WAN.htm?Highlight=sd-wan

This would be the best solution.

Akos

Re: Route outgoing traffic over specific ISP interface

IronMan — Mon, 16 Sep 2024 12:32:34 GMT

81.10.10 - that is the bugged version of what we've heard. I will give it a try with 81.10.15 probably (a very fresh version btw, only a few days ago released), will update this topic in a few days. Thank you