- Products
- Learn
- Local User Groups
- Partners
- More
Firewall Uptime, Reimagined
How AIOps Simplifies Operations and Prevents Outages
Introduction to Lakera:
Securing the AI Frontier!
Check Point Named Leader
2025 Gartner® Magic Quadrant™ for Hybrid Mesh Firewall
HTTPS Inspection
Help us to understand your needs better
CheckMates Go:
SharePoint CVEs and More!
Hi All,
I am facing issues with the bgp routes. I am able to see the imported routes with the show route all command but i am not able to see any of the routes in the route table(route -n). Could you please suggest me on this as soon as possible please.
Below is the config in place.
set as zzzzz
set router-id x.x.x.x
set bgp external remote-as xxxxx on
set bgp external remote-as xxxxx description Primary Peer
set bgp external remote-as xxxxx export-routemap "Inside_Routes" preference 1 on
set bgp external remote-as xxxxx import-routemap "MPLSRoutes-IN" preference 1 on
set bgp external remote-as xxxxx peer y.y.y.y on
set bgp external remote-as xxxxx peer y.y.y.y ping on
set bgp external remote-as xxxxx peer y.y.y.y export-routemap "Inside_Routes" preference 1 on
set bgp external remote-as xxxxx peer y.y.y.y import-routemap "MPLSRoutes-IN" preference 1 on
set bgp external remote-as xxxxy on
set bgp external remote-as xxxxy description SecondaryPeer
set bgp external remote-as xxxxy export-routemap "Inside_Routes" preference 2 on
set bgp external remote-as xxxxy import-routemap "MPLSRoutes-IN" preference 2 on
set bgp external remote-as xxxxy peer z.z.z.z on
set bgp external remote-as xxxxy peer z.z.z.z aspath-prepend-count 3
set bgp external remote-as xxxxy peer z.z.z.z ping on
set routemap MPLSRoutes-IN id 3 on
set routemap MPLSRoutes-IN id 3 allow
set routemap MPLSRoutes-IN id 3 match as xxxxx on
set routemap MPLSRoutes-IN id 3 match as xxxxy on
set routemap MPLSRoutes-IN id 3 match interface eth3 on
set routemap Inside_Routes id 4 on
set routemap Inside_Routes id 4 allow
set routemap Inside_Routes id 4 match as xxxxx on
set routemap Inside_Routes id 4 match as xxxxy on
set routemap Inside_Routes id 4 match network 10.10.10.10/32 exact
set routemap Inside_Routes id 4 match protocol static
I had similar issue with one customer and the only way to fix it was rebooting the firewalls after extensive troubleshooting and debugs with TAC. Odd thing in that scenario was that even though BGP config was there, it was stating from clish and BGP was not running...very strange.
If the route is showing up in the configuration (show route all) but not showing up in the live routing table, usually that means that the advertised nexthop gateway is not directly reachable through any of the firewall's interfaces. This exact scenario (which can certainly be confusing) was covered in my Gaia 3.10 Immersion course, here are the relevant pages:
It is also possible that your have a problem with your defined routemap and the learned routes are being "hidden" as a result, see here: sk87420: BGP routes are not shown in the output of 'show route' command, but are shown as 'hidden' i...
Thank you Timothy for the clear explanation on this. I can confirm the next hop if part of the subnet configured on one of the interfaces. Also verified the route map configuration on sk87420 still the issue doesn't seem to be resolved. Raised with TAC and waiting for the update.
I had similar issue with one customer and the only way to fix it was rebooting the firewalls after extensive troubleshooting and debugs with TAC. Odd thing in that scenario was that even though BGP config was there, it was stating from clish and BGP was not running...very strange.
Even Checkpoint suggesting to restart the route daemon as you suggested the_rock :). I have requested customer a window to perform this. Will let the chain knows the outcome. In the meanwhile could you please suggest on what i need to do if i need to advertise the default route to the peer based on t he above config shared?
I hate to tell you this, but I dont think restarting the routing deamon will do anything here...reboot might be needed.
Sure Rock will any install the latest hotfix so it will be rebooted. Will check the outcome and update this chain.
Hi All,
I do not see anything mentioned in the dynamic routing configuration for advertising the default route to the peer. Could you please suggest me on that. I went through the below community page but here it is mentioned that R80 doesn't support the 0.0.0.0/0 syntax.
https://community.checkpoint.com/t5/Security-Gateways/Gaia-R80-10-BGP-default-route/td-p/52156
Any suggestions on this please?
Redistributing from static or another protocol with appropriate filter list should work just fine or are you looking for something else?
Hi Chris,
Rebooting the firewall fixed the issue:)
Thanks for all your support.
Personally, what I always do is first look at /var/log/routed.log file on the firewall. If you see inconsistent messages there, thats your best clue that reboot is needed if restarting the routing daemon fails.
Cheers,
Andy
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
User | Count |
---|---|
14 | |
12 | |
11 | |
9 | |
8 | |
7 | |
5 | |
5 | |
5 | |
5 |
Tue 07 Oct 2025 @ 10:00 AM (CEST)
Cloud Architect Series: AI-Powered API Security with CloudGuard WAFThu 09 Oct 2025 @ 10:00 AM (CEST)
CheckMates Live BeLux: Discover How to Stop Data Leaks in GenAI Tools: Live Demo You Can’t Miss!Thu 09 Oct 2025 @ 10:00 AM (CEST)
CheckMates Live BeLux: Discover How to Stop Data Leaks in GenAI Tools: Live Demo You Can’t Miss!Wed 22 Oct 2025 @ 11:00 AM (EDT)
Firewall Uptime, Reimagined: How AIOps Simplifies Operations and Prevents OutagesAbout CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY