topic Re: ISP Redundancy (R80.10) - ISP monitored hosts question in General Topics

ISP Redundancy (R80.10) - ISP monitored hosts question

Vlad_Voronko — Fri, 21 Sep 2018 09:42:40 GMT

Hi,

I have a question about Advanced settings in ISP link configuration. It reads in the description "If any of the hosts in the list fail to respond, the Link is considered to be down" (see the picture). Is there any way to change this logic from "any of the hosts" to "all of the hosts"? In my opinion, "any of the hosts" logic might lead to significant amount of false positives on unstable links which might lead to frequent default route changes.

Re: ISP Redundancy (R80.10) - ISP monitored hosts question

Danny — Fri, 21 Sep 2018 11:00:32 GMT

I don't think there is a way to change this logic. It's best practice to select only hosts on stable links.

Re: ISP Redundancy (R80.10) - ISP monitored hosts question

Vlad_Voronko — Fri, 21 Sep 2018 11:17:10 GMT

Thanks for the reply, Danny. Well, I hope Checkpoint will add this feature in future releases.

Does anyone happen to know how many ping requests a security gateway sends towards the defined host? It can't be it just sends one ICMP request, right?

Re: ISP Redundancy (R80.10) - ISP monitored hosts question

Timothy_Hall — Fri, 21 Sep 2018 12:42:17 GMT

Actually it is possible to do this, it is a "hidden" setting described here:

sk102848: How to configure ISP Redundancy Link to fail over only when all configured hosts are not answering to pings

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

Re: ISP Redundancy (R80.10) - ISP monitored hosts question

Vlad_Voronko — Fri, 21 Sep 2018 13:09:33 GMT

Thanks a lot, Timothy. That's exactly what I've been looking for.

I hope it works for R80.10 too