Checkpoint and Cisco bond/etherchannel

[marcinw]

Hi,

I have Checkpoint 5100 and I am going to buy CPAC-8-1C-B expansion module with 8x Eth ports also I am going to buy GLC-T modules for Cisco 3850 and run Bond-Portchannel between them . My question before I start spending not my money 🙂 Will it be working ? Also how many links can I bundle on Checkpoint, 8 as on Cisco ?

thanks

Marcin

[Chris_Atkinson]

Up to 8 slaves are supported, bond will work fine with Cisco.

[HeikoAnkenbrand · Accepted solution]

Hi @marcinw,

I agree with @Chris_Atkinson , you can theoretically build a bond of 8 interfaces.

But from a performance point of view I would take two bond interfaces with 4 interfaces per bond. The Check Point FW works more effectively if you use different input and output interfaces. With one bond you reduce the network throughput, if the same interface is used for incoming and outgoing packets.

[Chris_Atkinson · Accepted solution]

From a performance perspective we should also consider the capabilities of the 5100 platform and throughput expectations dependent upon enabled_blades etc.

[marcinw]

OK guys,

The situation that I found ( I am new engineer in this place) is "router on the stick" (sic!) . at this moment I have single link between ETH2 on  the 5100 and Cisco stack 3750. We have around 30 VM on Vlan 24 (server farm 4 ESXi hosts) and 250 internal users (usually around 70 are active) on Vlan 26. I could deploy intervlan traffic on Cisco switches but we have a lot of policies deployed on the 5100 between Vlan 24 and 26 (That would have to be replaced with access-list then) . At this moment I would like to try with portchannel. The traffic on the outside interface is relatively small so I think portchannel on the Inside interface that routes traffic between Vlans would help. Because you raised this, I am wondering on the number of links that I should use ...   Maybe I start with 4 and if there will be no impact on performance I add next 2 or 4  

[Chris_Atkinson]

Your approach is sound, please monitor the traffic/load and adjust as necessary.