topic Re: Static routing not working after policy install in Spark Firewall (SMB)

Static routing not working after policy install

HristoGrigorov — Thu, 11 Oct 2018 03:41:41 GMT

Hi,

Is anyone able to easily confirm this?

1. Have two ISP connections: ISP-A and ISP-B configured in HA mode.

2. Add following static routes:

src: 192.168.0.0/24 via ISP-B, metric:10

src: 192.168.0.0/24 via ISP-A, metric: 20

3. Observe static routing works fine and outgoing connections pass through ISP-B.

4. Do just any change and install policy.

5. Observe static routing no longer works and in fact outgoing traffic is stuck and does not go through either of the ISP connections.

Re: Static routing not working after policy install

PhoneBoy — Fri, 12 Oct 2018 11:58:07 GMT

What appliance and code version?

How did you configure the ISP redundancy?

Re: Static routing not working after policy install

HristoGrigorov — Fri, 12 Oct 2018 14:36:23 GMT

Thanx and sorry, forgot to mention it:

This is Check Point's 1470 Appliance R77.20.80 - Build 437

and

ISP redundancy is in High-Availability mode with ISP-A being Primary and the other Secondary. Both ISPs are sharing same WAN interface using VLANs.

Re: Static routing not working after policy install

PhoneBoy — Sat, 13 Oct 2018 07:58:30 GMT

The other relevant question: locally managed or via external security management?

Based on what you're describing it seems like latter.

Also, is it all traffic going out 192.168.0.0/24 that fails after a policy push?

Re: Static routing not working after policy install

HristoGrigorov — Sat, 13 Oct 2018 12:19:59 GMT

Yes, centrally managed. Only traffic that is supposed to go out through WAN interface fails. Other (internal) traffic works fine.

Re: Static routing not working after policy install

PhoneBoy — Sun, 14 Oct 2018 12:27:14 GMT

Is it ALL WAN traffic or just traffic destined for 192.168.0.0/24?

Either way, this seems like a bug and you should open a TAC caseso we can collect the appropriate Troubleshooting.

Re: Static routing not working after policy install

HristoGrigorov — Sun, 14 Oct 2018 18:57:23 GMT

It is outgoing routing, so only traffic from 192.168.0.0/24 to WAN is not working. I wanted quick confirm from someone else before I engage TAC because it all seem kind of peculiar to me and I am not sure if problem is not something I am doing wrong.

Re: Static routing not working after policy install

Maarten_Sjouw — Sat, 20 Oct 2018 20:09:11 GMT

Have you tried using the actual IP of the IPS-A and ISP-B gateways instead of the ISP-A or B setting?

Re: Static routing not working after policy install

HristoGrigorov — Mon, 22 Oct 2018 03:49:38 GMT

Thanx for the suggestion. I tried it but unfortunately end result is the same. What I noticed however is that there is still connectivity, I can telnet for example to port 80 or 443. So it must be some of the AC/UF blades that is failing.

Re: Static routing not working after policy install

HristoGrigorov — Mon, 26 Nov 2018 17:57:29 GMT

I have opened SR now and we are investigating it together with TAC. I will demand fix for this because it is the only way to have working SecureXL and still utilize secondary ISP somehow. Even though it is a manual way to do it.

Will update when there is a progress...