topic Re: P2P Config compatibility in Active/Standby Cluster in General Topics

P2P Config compatibility in Active/Standby Cluster

SriNarasimha005 — Mon, 20 Oct 2025 17:46:40 GMT

Hi Experts,

We're planning to replace a Cisco ASA firewall with the Checkpoint firewalls which has P2P link connected. The requirement is that Checkpoint firewalls in HA (Active/Standby) should be able to support the P2P link configuration.

Below is the overview of the architecture. Is this a correct design?

Vendor Firewall (Source) -> P2P link -> Cisco Switches -> Checkpoint firewalls -> Application (Destination)

With regards to the ISP redundancy, I'm unable to find any in R81.X and the last one is related to R80.40 (ISP Redundancy on a Cluster)

1. I believe P2P link configuration is similar to the ISP redundancy. Is my understanding correct?

2. If yes, can you please let me know if the newer versions supports ISP Redundancy on a Cluster?

3. As described in the R80.40 documentation, I don't have any default route towards Internet to monitor the next hop IP. Rather, specific traffic is being allowed towards the core network from the vendor side with the return route. Is it a correct config/design to support ISP redundancy?

Thank you.

Re: P2P Config compatibility in Active/Standby Cluster

PhoneBoy — Mon, 20 Oct 2025 20:16:56 GMT

We don't support configuring PPPoE with ClusterXL: https://support.checkpoint.com/results/sk/sk101747
Also, ISP Redundancy usually involves multiple Internet connections with a default route.

Re: P2P Config compatibility in Active/Standby Cluster

the_rock — Mon, 20 Oct 2025 23:10:21 GMT

Personally, I would get an official confirmation from your local SE and TAC.

Re: P2P Config compatibility in Active/Standby Cluster

SriNarasimha005 — Tue, 21 Oct 2025 00:13:14 GMT

Hi @PhoneBoy

Thanks for the information. Does it support on a checkpoint over a standalone firewall?

Please note that the links are getting connected to the switch as highlighted.

Thank you.

Re: P2P Config compatibility in Active/Standby Cluster

Chris_Atkinson — Tue, 21 Oct 2025 00:37:13 GMT

Do you mean P2P in the context of OSPF configuration or something else?

Re: P2P Config compatibility in Active/Standby Cluster

SriNarasimha005 — Tue, 21 Oct 2025 01:59:21 GMT

@Chris_Atkinson wrote:
Do you mean P2P in the context of OSPF configuration or something else?

This is P2P link and not related to OSPF

Re: P2P Config compatibility in Active/Standby Cluster

the_rock — Tue, 21 Oct 2025 02:03:28 GMT

As Phoneboy said, its PPPOE?

Re: P2P Config compatibility in Active/Standby Cluster

SriNarasimha005 — Tue, 21 Oct 2025 07:18:30 GMT

Hi @the_rock @PhoneBoy

Sorry for the confusion. P2P it's a wider term which has been used and it's not a PPPoE. It's a MPLS/Metro-E private link with RJ-45 ports, UTP cables being used.

With the attached design, I believe it'll automatically provide redundancy in the scenarios if any of the link/switch/firewall goes down. I'm happy to be corrected 😊

Re: P2P Config compatibility in Active/Standby Cluster

the_rock — Tue, 21 Oct 2025 08:44:40 GMT

Ah, point 2 point you mean 🙂

Re: P2P Config compatibility in Active/Standby Cluster

emmap — Tue, 21 Oct 2025 09:29:32 GMT

I think the short answer would be that we would recommend an alternate HA solution here, but would need a more complete understanding of the setup to fully settle on how to do it. Probably best to chat to your local sales office about options here.

Re: P2P Config compatibility in Active/Standby Cluster

PhoneBoy — Tue, 21 Oct 2025 18:57:00 GMT

Why wouldn't you just configure static routes for the relevant network(s) on both gateways in this case?
This would need to be done anyway to ensure that traffic doesn't get lost when a failover occurs on the cluster.

Re: P2P Config compatibility in Active/Standby Cluster

the_rock — Tue, 21 Oct 2025 19:04:49 GMT

Makes total sense.