ISP Redundancy - NAT

[dede79]

Hello,

as tested outbound traffic hide-nat works with ISP redundancy (act/standby)  when selecting hide behind gateway in the network object. Solution should be sk25152.

Is there an option to do so with dynamic objects? Most customers use manual nat with groups in source column.

I tested in lab with 2 dynamic objects:

[Expert@ISPgw01:0]# dynamic_objects -l

object name : DYN_ISP_A
range 0 : 0.0.0.0 255.255.255.255

object name : DYN_ISP_B
range 0 : 0.0.0.0 255.255.255.255

Since $FWDIR/bin/cpisp_update script looks really different than in the sk I did not change it.

created the same objects in dashboard and made 2 nat rules:

If ISP A fails default route is switched to ISP B but the still the public hidenat IP of ISP A is used - Rule 5 always matches.

Version R81.10

[G_W_Albrecht · Accepted solution]

>> Since $FWDIR/bin/cpisp_update script looks really different than in the sk I did not change it.

You have too - enter the needed lines as shown in sk25152 or the Dynamic objects will not change. sk25152 has more NAT rules and ARP Requests for the Manual NAT IP to be taken care of.

[dede79]

OK, I think I skipped the "add" in the sk - now it works - manual HNAT  Rules...manual SNAT in/out for the DMZ Servers - great!

[Jones]

Hi,

sk25152 describes a script for two ISP's in a loadsharing solution. From R81.10 more then two ISP's are supported. So what about a High Available solution with three ISP's, that should also be possible. What lines in the cpisp_update are then needed for this solution?

Grtz Jones

[Jones]

I got a reply from Check Point support. They updates sk25152 and gave me the cpisp_update lines for 3 ISP's that I added it in this post. Don't forget to add two extra lines on the CLI:

dynamic_objects -n DYN_ISP_C
dynamic_objects -o DYN_ISP_C -r 0.0.0.0 0.0.0.0 -a

[dede79]

Just have same config with R81.20 but not working...

Do the dynamic-objects / object names in the script MUST be exactly "DYN_ISP_A" and so on or can I use other names like "DYN_ISP_COLT"....?

Regardinf ISP Red in loadsharing and sk25152- there is still mentioned that the solution is only for HA. So there the only option is hide-behind-gateway ?

[Wolfgang]

• @dede79 What do you want to achieve?  The „hide behind gateway“ setting is the solution for outgoing connections and ISP redundancy. You don‘t wrote what‘s your problem. You wrote „ Solution should be sk25152“ but which problem?

[dede79]

are you really able to hide everything behind gateway in you environments? No need to use specific IPs for NAT?

[dede79]

Update from TAC: sk25152 not supportet from R81.10 upwards. Supportet workaround would be using manual nat rules with zone in destination field.

[cyberfinder]

specific Ip hide NAT will work with ISP load sharing mode ? as i have tried seems like its not supported.