topic Re: ISP Redundancy 101 in General Topics

ISP Redundancy 101

pgestido — Tue, 01 Jul 2025 18:33:01 GMT

Hi:

I have questions about ISP redundancy (I am working with R81.20)

I will describe a basic scenario

One Gw with

LAN interafce 192.168.1.1 (LAN is 192.168.1.0)

ISP1 Interface (1.1.1.1, ISP Gw 1.1.1.2)

ISP2 Interface (2.2.2.1 ISP Gw 2.2.2.2)

1) When configuring ISP Reduandancy should I configure 2 default routes in GAIA? or is it configured automaticaly by ISP Redundancy?

2) If you configure a NAT Hide (behind the Gateway) I guess the traffic is NATed with the IP of the ISP the traffic is going out. Is that right?

3) What happens If I NAT inside network with ISP1 IP (1.1.1.1). It may happen that with ISP reduandancy the outgoing traffic is getting out by ISP2. Will the gateway NAT the traffic (going out by ISP2) with ISP1 IP ?

Thanks for your help,

Pablo

Re: ISP Redundancy 101

the_rock — Tue, 01 Jul 2025 19:24:44 GMT

1) When configuring ISP Reduandancy should I configure 2 default routes in GAIA? or is it configured automaticaly by ISP Redundancy?

I would configure that in case of main link failure.

2) If you configure a NAT Hide (behind the Gateway) I guess the traffic is NATed with the IP of the ISP the traffic is going out. Is that right?

yes

i believe so

Andy

Re: ISP Redundancy 101

Ave_Joe — Wed, 02 Jul 2025 00:22:13 GMT

I recommend starting with sk61692.
The NAT piece is important. You will have to uncheck the "Hide internal networks behind the Gateways external IP" in the gateways properties.
All internal networks objects will need to be changed to "Hide behind the gateway" and selecting the correct gateway.
For VPN traffic to work as needed in all link failure cases I recommend looking at sk180956.

Hope this helps.

Re: ISP Redundancy 101

the_rock — Wed, 02 Jul 2025 00:24:31 GMT

Yup...totally valid points @Ave_Joe

Andy

Re: ISP Redundancy 101

G_W_Albrecht — Wed, 02 Jul 2025 07:55:56 GMT

See https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityGateway_Guide/Content/Topics-FWG/ISP-Redundancy-Configuration.htm for configuration steps ! When an ISP link state changes, the $FWDIR/bin/cpisp_update script runs on the Security Gateway: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityGateway_Guide/Content/Topics-FWG/ISP-Redundancy-CLI.htm?Highlight=The%20ISP%20Redundancy%20Script

sk32225 - Configuring ISP Redundancy so that certain traffic uses specific ISP Link

Re: ISP Redundancy 101

G_W_Albrecht — Wed, 02 Jul 2025 09:28:05 GMT

You are wrong - 1.) When an ISP link state changes, the $FWDIR/bin/cpisp_update script runs on the Security Gateway. This script changes the default route of the Security Gateway.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityGateway_Guide/Content/Topics-FWG/ISP-Redundancy-CLI.htm?Highlight=The%20ISP%20Redundancy%20Script

For 2.) see https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityGateway_Guide/Content/Topics-FWG/ISP-Redundancy-Configuration.htm?Highlight=Manual%20Static%20Rules%20for%20a%20Web%20Server%20and%20a%20DNS%20Server

Also answer to 3.) is false ! After default route is changed the traffic will go out with ISP2 IP.

Re: ISP Redundancy 101

the_rock — Wed, 02 Jul 2025 11:43:34 GMT

Not based on my experience with the customers. I had 3 customers experience the issue where if you have ONLY 1 default gateway, if main link goes down, bunch of stuff wont work. You are welcome to test it in the lab and Im positive you would see exact same results.

Andy