topic Re: About ISP Redundancy monitor in Spark Firewall (SMB)

About ISP Redundancy monitor

michaelyang123 — Wed, 05 Mar 2025 09:38:37 GMT

Hello Expert,

When I tested ISP Redundancy, I found that it is not compatible with PBR.

Here is structure.

So I changed to use two next hops on the static route, and use priority to divide the primary and the secondary.

I found out that the only way to checkpoint to make sure the route works is to make sure the next hop is viable.

For example, if I turn off Gi0/0 on S3 it switches to the second line for service, but if I turn off Gi0/1 on S3 the checkpoint continues to the first line without switching.

Is there a way to configure the first line to ping the IP of the external network? (transparent monitor)
For example, ping 8.8.8.8 through 30.30.30.30 to make sure that this line can reach the external network.

Thanks

Re: About ISP Redundancy monitor

_Val_ — Wed, 05 Mar 2025 11:51:47 GMT

Before anything else, can you please state the appliance model and SW version in use?

Re: About ISP Redundancy monitor

_Val_ — Wed, 05 Mar 2025 12:00:06 GMT

According to sk167135, PBR is not supported with ISP redundancy.

Re: About ISP Redundancy monitor

michaelyang123 — Wed, 05 Mar 2025 12:08:59 GMT

Hi @_Val_ ,

Thanks for your reply.

I know PBR is not supported with ISP redundancy.

So I changed to use two next hops on the static route, and use priority to divide the primary and the secondary.

Is there a way to configure the first line to ping the IP of the external network? (like transparent monitor)
For example, ping 8.8.8.8 through 30.30.30.30 to make sure that this line can reach the external network.

---

All my device models are VE.

Re: About ISP Redundancy monitor

PhoneBoy — Wed, 05 Mar 2025 15:34:07 GMT

I believe this will do what you're after: https://support.checkpoint.com/results/sk/sk102848

Re: About ISP Redundancy monitor

michaelyang123 — Wed, 05 Mar 2025 15:58:09 GMT

Hi @PhoneBoy ,

I didn't use ISP redundancy because it's not compatible with PBR.

---

According to my setup

I thought the setup was to ping 8.8.8.8 via this path (30.30.30.30), but it turns out it is just the device that has to ping 8.8.8.8, regardless of the path!

Re: About ISP Redundancy monitor

PhoneBoy — Fri, 07 Mar 2025 00:12:05 GMT

This may be a limitation, I would check with TAC.

Re: About ISP Redundancy monitor

DeltaUnit — Tue, 11 Mar 2025 01:17:01 GMT

you only need one default route - the ISP redundancy configuration is done using the smart console - Gateways and servers - open the gateway object - others tab - ISP redundancy. https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityGateway_Guide/Content/Topics-FWG/ISP-Redundancy-Configuration.htm

Re: About ISP Redundancy monitor

michaelyang123 — Tue, 11 Mar 2025 02:28:39 GMT

Hi @DeltaUnit ,

Thanks for your reply.

Since I'm going to use PBR, I won't consider using "ISP redundancy" function because it's not compatible.