topic Checkpoint BGP ECMP/Multipath in General Topics

Checkpoint BGP ECMP/Multipath

sinapz — Fri, 22 Nov 2024 01:41:51 GMT

I am looking to understand how Checkpoint Cloudguard BGP routing works when ECMP is enabled. I've got 2 equal paths to a destination, and I want to install routes learnt from both paths into the routing table. However, I want to ensure that traffic from the same source IP is always sent to the same path (client persistency).

Is there a way to configure this sort of hashing (source-IP persistency) within ECMP?

Re: Checkpoint BGP ECMP/Multipath

Duane_Toler — Fri, 22 Nov 2024 03:05:49 GMT

With two equal cost paths, they both will be installed to the routing table (the FIB). Routing is based on destinations, not sources. You need PBR for source based routing (don’t do PBR; it’s an endless pit of trouble unless you absolutely positively must). Even source NAT doesn’t solve the issue.

If you want to ensure a packet travels via a predetermined path then you don’t have ECMP anymore. You can use BGP path attributes to influence path decisions between ASNs if you need that. Local_Pref, AS_Path, and/or Weight (locally significant to the router only) to exit an AS; MED to enter an AS.

Re: Checkpoint BGP ECMP/Multipath

Chris_Atkinson — Fri, 22 Nov 2024 03:22:02 GMT

Per sk100504:

"Round robin" next hop algorithm is not supported.
"Source hash" next hop algorithm is not supported.
"Destination hash" next hop algorithm is not supported.
ECMP over EBGP supports up to 8 simultaneous routes.

Re: Checkpoint BGP ECMP/Multipath

sinapz — Fri, 22 Nov 2024 03:30:16 GMT

Thanks for your feedback. Unfortunately, BGP Attributes will not solve my problem, as I need traffic to be routed across 2 paths. Adding local pref will only make traffic go via one path. What I need is the ability to load balance based on a source-ip-based algorithm

Re: Checkpoint BGP ECMP/Multipath

sinapz — Fri, 22 Nov 2024 05:31:49 GMT

That's a shame but thanks for researching