ISP redundancy questions

[Jakub132620]

Hello,

We have a 9400 series appliance running Gaia R82, and we are planning to add a second Internet connection from another ISP.

After reading the R82 ClusterXL Administration Guide, I still have a few questions. I’m not sure if I understood everything correctly.

Let’s assume that we received an additional public IP address pool from both ISPs.

1) in Load Sharing mode, for outbound Internet traffic we can only use the “Hide behind gateway” NAT option?

2) What if we have a public IP address pool provided by the ISP? In that case, is it possible to use the “Hide behind IP address” option, or configure Manual NAT instead in load sharing option?

3) In Active/ Backup mode we are using maunla nat rules described in sk174197 and sk25152 ? 

4)

In the Administration Guide, in the “Incoming Connections” section, it is described that a server accessible from the Internet receives two public IP addresses, one from each ISP and we have two manula static rules.

Later, it is mentioned that the DNS query reaches the cluster. If I understood correctly, the cluster has a kind of built-in DNS functionality that can respond to DNS A record queries.

Does this mean that the organization must host its own DNS server internally, and that the DNS server cannot be located outside the company?

A lot of uncertainties came to my mind while reading the documentation. Could someone please clarify these points for me?

Thank you in advance for your answers.

[simonemantovani]

Hello

about DNS resolution; the DNS query must be intercepted by the firewall, so DNS server must be behind the firewall.

In the past I configured this feature for a customer, and yes, DNS server are hosted on-premise; so this could be a limit; if your DNS provider supports some kind of availability monitor for your public IPs and some kind of failover maybe you can manage the switch between your ISP automatically. But it depends of who is managing and hosting your DNS zones.

[Jakub132620]

Thans for reply. What about ISP redundancy in load sharing mode. It's ony possible to use hide behind gateway option in this mode?

[PhoneBoy]

For outbound connections, yes.
See: https://support.checkpoint.com/results/sk/sk34812