topic Re: Asymmetric routing with checkpoint inline. in General Topics

Asymmetric routing with checkpoint inline.

Sameer_Basha — Sat, 06 Apr 2019 10:35:48 GMT

Hello

customer is a TELCO/ISP and has procured checkpoint 15600 cluster. firewall will be used to filter customers traffic and apply quality of service on them. customer wants the firewall to support asymmetric traffic. only the outgoing connections will go through the firewall and return traffic will be directly routed to the core switch from the router. i have attached the design.

default gateway of core switch is firewall

on the router the return traffic is routed back to the core switch.

is there any way we can make it work. please confirm

Re: Asymmetric routing with checkpoint inline.

Neville_Kuo — Sat, 06 Apr 2019 11:34:40 GMT

Maybe dynamic routing protocols can achieve your requirement....

CP15600 cluster points the default static route to internet router, then redistribute to ospf instance, then core switch would learn this default information, the client traffic will then go through core switch->CP15600 cluster->internet router, as for the return traffic, because internet router will learn all the vlans information from core switch, so return traffic would be internet routers->core switch->user subnets.

Or you may simply use PBR on internet routers to force return traffic go through core switches.

Re: Asymmetric routing with checkpoint inline.

Sameer_Basha — Sat, 06 Apr 2019 11:48:01 GMT

There is no routing concern here. firewall is not seeing full connection and will drop out of state packets. i also disabled drop out of state packets from global properties to allow out of state packets but still its not working. we are able to ping but not access any website. in this design customer wants to use web filtering and QOS

Re: Asymmetric routing with checkpoint inline.

Neville_Kuo — Sat, 06 Apr 2019 12:09:05 GMT

Oh, I forgot to tell you such network design will cause many software blades invalid, because some deeper inspections or L7 functions needs to check return traffic as well.

And you can use zdebug or fw minitor to debug packet drop issues, I think you can check inspection settings, some tcp check will drop traffic.