Virtual Router - PA Equivalent

[Krishnan]

Hi,

Currently we have a PA Firewall (800 series) on which he has created two virtual routers and one is used for voice traffic which has a different gateway and the other one has data which has a different networks and different ISP. How can it be achieved in Checkpoint Firewall ? I know we can use PBR for voice traffic however what is the exact equivalent for the same? This is very similar to vrf concepts. Can it be achieved in say 3200 Checkpoint Firewall ?

[Chris_Atkinson · Accepted solution]

VSX provides virtualization of a security gateway and allows creation of Virtual Firewall Systems & Virtual Routers.

[Krishnan]

Hello,
How can we do without creating virtualization ?
1. If we are creating virtualization, do we need any license for that ?
2. Don't we have any equivalent to have different vrfs.

[Chris_Atkinson]

Two VS are included by default.

Paid license increments are 3,10,25,50

e.g. 

CPSB-VS-3 (primary gateway)

CPSB-VS-3-VSLS (standby gateway)

[Krishnan]

But is there any equivalent for vrf with single instance instead of creating two ? Because in the existing they have a single instance of firewall with two virtual routers (PA). So will prefer the same.

[Chris_Atkinson]

Aside from MDPS the only other choice that may be relevant is multi-instance OSPF depending on your actual requirements.

[Krishnan]

Thanks Chris

[ikafka]

Hi Krishnan

Can you share how you resolved this situation? I need to find the best solution in the same situation right now.

Thanks. 

[Chris_Atkinson]

Note with VSX, Virtual Routers don't consume a VS license.

[Bob_Zimmerman]

Did this change recently? Router contexts definitely did consume license slots in the past. I don't use router contexts, so I don't notice changes to how they work. The only VS type which I know has never consumed a slot is a switch.