topic Re: Dual ISP on Checkpoint R81 in Spark Firewall (SMB)

Dual ISP on Checkpoint R81

glenn22x — Thu, 02 May 2024 14:45:09 GMT

Hello everyone,

I am very new to Checkpoint firewall configuration. I would like to set up ISP redunancy on our new R81 gateway. I see WAN A and WAN B and assumed that I could set up load sharing from the 2 ISPs in the web interface, but that appears to not be the case. We are using firmware revision R81.10.10. How can I configure ISP redundancy using the web interface? or do I need to use SSH and the CLI?

Re: Dual ISP on Checkpoint R81

the_rock — Thu, 02 May 2024 16:52:30 GMT

Locally or centrally managed?

Andy

Re: Dual ISP on Checkpoint R81

the_rock — Thu, 02 May 2024 16:54:42 GMT

For locally managed, below may help:

https://sc1.checkpoint.com/documents/SMB_R80.20/AdminGuides/Locally_Managed/EN/Content/Topics/Configuring-Internet-Connectivity.htm?Highlight=isp%20redundancy

Centrally managed:

https://sc1.checkpoint.com/documents/SMB_R80.20/AdminGuides/Centrally_Managed/EN/Content/Topics/Configuring-Internet-Connectivity.htm?Highlight=isp%20redundancy

Re: Dual ISP on Checkpoint R81

glenn22x — Thu, 02 May 2024 18:18:04 GMT

Hi Andy, just locally managed.

Re: Dual ISP on Checkpoint R81

glenn22x — Thu, 02 May 2024 18:39:31 GMT

HI Andy,

So Based on the article you linked I was able to figure out that I cannot use the WAN B Port, I had to unassign a LAN port and use that for the secondary ISP. That's fine, that is working now as intended. I don't see an option to switch between failover and load balancing though... does it default to load balance? It is operating in SD-WAN mode, and there is an option to be a part of the SD-WAN or set as backup in SD-WAN. I am to take it that being a part of SD-WAN is load balanced connections?

Re: Dual ISP on Checkpoint R81

the_rock — Thu, 02 May 2024 23:39:08 GMT

Hey Glenn,

Do you see all the options listed below from that link? Anyway, gonna go now watch some hockey, lets see who dominates tonight, Bruins or Leafs lol

Andy

From the link:

ISP Redundancy - supported in IPv4 connections only

Multiple Internet connections can be configured in High Availability or Load Sharing modes. When you configure more than one Internet connection, the Device > Internet page lets you toggle between these options. The Advanced setting of each Internet connection lets you configure each connection's priority or weights based on the set mode.

Clear the Route traffic through this connection by default checkbox when you do not want this Internet connection used as a default route for this gateway. The connection is used by the device only if specific, usually service-based, routing rules are defined for it. This is commonly used when you have a connection that is used for dedicated traffic. When you clear this option, this connection does not participate in High Availability or Load Balancing.
High Availability - Priority - Select the priority for the connection. Lower priority connections are only used if higher priority connections are unavailable.
Load Balancing - Weight - The traffic to the Internet is divided between all available connections based on their weights.

Re: Dual ISP on Checkpoint R81

glenn22x — Fri, 03 May 2024 13:43:00 GMT

Hi Andy,

Looks like the Leafs won!

I've attached a pic of the options I get for ISP redundancy. From how it is worded it sounds to me like it would load balance until failure, then prioritize based on what connections remain in the event of a connection failure?

Re: Dual ISP on Checkpoint R81

glenn22x — Fri, 03 May 2024 14:20:06 GMT

Hi Andy,

After some further investigation, I found a section of the web interface specifically related to the SD-WAN and found the image attached. Looks like it's running in link aggregation which is exactly what I want. So problem solved! have a great weekend!

Re: Dual ISP on Checkpoint R81

the_rock — Fri, 03 May 2024 15:49:20 GMT

Yes, game 7 tomorrow 🙂

That looks right!

Re: Dual ISP on Checkpoint R81

the_rock — Fri, 03 May 2024 15:49:33 GMT

Good job!