Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
marcinw
Participant

Checkpoint and Cisco bond/etherchannel

Jump to solution

Hi,

I have Checkpoint 5100 and I am going to buy CPAC-8-1C-B expansion module with 8x Eth ports also I am going to buy GLC-T modules for Cisco 3850 and run Bond-Portchannel between them . My question before I start spending not my money 🙂 Will it be working ? Also how many links can I bundle on Checkpoint, 8 as on Cisco ?

thanks

Marcin

0 Kudos
2 Solutions

Accepted Solutions
HeikoAnkenbrand
Champion
Champion

Hi @marcinw,

I agree with @Chris_Atkinson , you can theoretically build a bond of 8 interfaces.

But from a performance point of view I would take two bond interfaces with 4 interfaces per bond. The Check Point FW works more effectively if you use different input and output interfaces. With one bond you reduce the network throughput, if the same interface is used for incoming and outgoing packets.

View solution in original post

Chris_Atkinson
Employee
Employee

From a performance perspective we should also consider the capabilities of the 5100 platform and throughput expectations dependent upon enabled_blades etc.

View solution in original post

0 Kudos
5 Replies
Chris_Atkinson
Employee
Employee

Up to 8 slaves are supported, bond will work fine with Cisco.

 

0 Kudos
HeikoAnkenbrand
Champion
Champion

Hi @marcinw,

I agree with @Chris_Atkinson , you can theoretically build a bond of 8 interfaces.

But from a performance point of view I would take two bond interfaces with 4 interfaces per bond. The Check Point FW works more effectively if you use different input and output interfaces. With one bond you reduce the network throughput, if the same interface is used for incoming and outgoing packets.

View solution in original post

Chris_Atkinson
Employee
Employee

From a performance perspective we should also consider the capabilities of the 5100 platform and throughput expectations dependent upon enabled_blades etc.

View solution in original post

0 Kudos
marcinw
Participant

OK guys,

The situation that I found ( I am new engineer in this place) is "router on the stick" (sic!) . at this moment I have single link between ETH2 on  the 5100 and Cisco stack 3750. We have around 30 VM on Vlan 24 (server farm 4 ESXi hosts) and 250 internal users (usually around 70 are active) on Vlan 26. I could deploy intervlan traffic on Cisco switches but we have a lot of policies deployed on the 5100 between Vlan 24 and 26 (That would have to be replaced with access-list then) . At this moment I would like to try with portchannel. The traffic on the outside interface is relatively small so I think portchannel on the Inside interface that routes traffic between Vlans would help. Because you raised this, I am wondering on the number of links that I should use ...   Maybe I start with 4 and if there will be no impact on performance I add next 2 or 4  

0 Kudos
Chris_Atkinson
Employee
Employee

Your approach is sound, please monitor the traffic/load and adjust as necessary.

0 Kudos