topic Re: Quantum Spark Traffic Management in Spark Firewall (SMB)

Quantum Spark Traffic Management

khineminn — Thu, 14 Nov 2024 14:29:14 GMT

We configured two manual NATs for one web servers, with one NAT rules is applied for each ISP's public IP.

ISP-1 (WAN) > 10.10.10.100 to 172.16.10.100
ISP-2 (DMZ) > 20.20.20.100 to 172.16.10.100

The primary link is through ISP-1, with Priority 1.
The secondary link is through ISP-2, with Priority 100.
Therefore, the default route preference is set to use ISP-01.

Issue:

When accessing IP address 10.10.10.100, the connection works without any issues.

However, when accessing 20.20.20.100, the connection fails. After capturing and analyzing the traffic, I found that the firewall is responding to packets through ISP-1 (according to the default route) instead of the incoming interface.

Question:

Is this behavior normal, or is it possible for the firewall to respond to packets through the same interface they arrived on?

Re: Quantum Spark Traffic Management

Chris_Atkinson — Thu, 14 Nov 2024 15:33:17 GMT

Without some form of PBR or SD-WAN config, following the routing table is absolutely normal and correct.

Is this R81.10.10 or R81.10.15?

Re: Quantum Spark Traffic Management

khineminn — Thu, 14 Nov 2024 15:39:22 GMT

@Chris_Atkinson R81.10.15

Traffic may arrive via multiple ISP links due to DNS resolution. Are there any solutions to achieve this type of setup?

Thanks.

Re: Quantum Spark Traffic Management

PhoneBoy — Thu, 14 Nov 2024 18:11:10 GMT

For regular (non-SMB) gateways, or even if the SMB is centrally managed, you could try: https://support.checkpoint.com/results/sk/sk42636
If locally managed, you can try editing $FWDIR/conf/routing_configload.conv and changing misp_cache_use_srv to true, then do a fw configload to refresh the configuration.
Whether that works is a separate question and if it doesn't suggest a TAC case.