Check Point Firewall: Policy-Based Routing (PBR) | Dual ISP Configuration Guide

[Moudar]

Check Point Firewall: Policy-Based Routing (PBR) | Dual ISP Configuration Guide

In this video, we break down Policy-Based Routing (PBR) in Check Point Gaia and show how it gives you full control over traffic flow—far beyond traditional routing.

To view this video, you must Accept and consent to the use of cookies.

Accept

[Amit_Navon]

@Moudar 

PBR is important, in addition it is recommended to enable the SD-WAN blade so Enterprise will benefit from:

• Steering policy per application:
  Local breakout, VPN, SASE Backbone
• Multiple ISPs: Fiber, 5G, Satellite
• Network Probing
• Observability & Troubleshooting
• AI Remediation

Best Regards,

Amit Navon

Product Manager

SD-WAN

Check Point Software Technologies

[AlessandroCosma]

Thank you @Moudar for the video; it was very helpful.

The video covers outbound traffic.

But what’s the correct way to handle inbound traffic, for example, for exposed services?

Still using PBR?

Because the main issue with exposed services, when you have two or more ISPs, is return traffic, since this traffic MUST flow symmetrically.

Let’s say we have two ISPs: ISP-A is the primary one and ISP-B is the secondary one. We’d like to expose a service (for example, an HTTPS web server) through ISP-B.

So far, the correct method I’ve followed is to create an action table with the relevant gateway for ISP-B (ISP-B-Action-Table) and then create 4 PBRs:

set pbr rule priority 1 match from <HTTPS_Web_Server_ip>

set pbr rule priority 1 match to 10.0.0.0/8

set pbr rule priority 1 action main-table

set pbr rule priority 2 match from <HTTPS_Web_Server_ip>

set pbr rule priority 2 match to 172.16.0.0/12

set pbr rule priority 2 action main-table

set pbr rule priority 3 match from <HTTPS_Web_Server_ip>

set pbr rule priority 3 match to 192.168.0.0/16

set pbr rule priority 3 action main-table

set pbr rule priority 4 match from <HTTPS_Web_Server_ip>

set pbr rule priority 4 action table ISP-B-Action-Table

The first three rules ensure that internal network traffic is routed correctly, while rule No. 4 allows traffic from the web server to exit via ISP-B (which also ensures that return traffic exits in the same way).

Now, with the SD-WAN blade, could this PBR configuration maybe be avoided?

Thank you for you help,

Regards,

[AmirArama]

Indeed,

SD-WAN has Symmetric Return function, which returns the packets symmetrically from the same ISP.
with that, you can even expose a server via multiple ISPs in parallel, and get the response in symmetric way from each ISP.