Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Collaborator

Dedicated routing table of Mgmt Port Require In checkpoint which is not available in present device

Jump to solution

As I see when we have assign any IP to management interface we can only able to communicate management Interface IP from Same Subnet , I need same management interface IP should be routeable with another VLAN , and This Management interface has own routing domain .

 

If we have requirement LIke Special Mangement VLAN customer have and all device MGMT port connected with Same Switch right so if we can reach mangement from this vlan we can communicate and if we requirement to communicate mgmt ip from diffrent subnet so in this case we require default gateway should be configured in Checkpoint .

 

This is as i observe so please if anybody have any workaround please let us know

Harmesh Yadav
2 Solutions

Accepted Solutions
Highlighted
Leader
Leader

As Aleksey wrote, there is no own routing instance for the management interface and this interface works same like any other.

To reach other subnets in your management VLANs you can configure routes going out via the management interface. And you can limit the connections via the rulebase.

But if you have to physical seperate you have to use another solution...

Another option will be to use VSX (if it is supported on your appliance and you have the license). With this you can put your management completly an a seperate network and run your firewall as an virtual system with no connectivity to the management.

And additional you have on most of the larger appliances a LOM card which you could connect to the management VLAN.

But you can use the LOM port only to connect to the console of the appliance, It is not possible to have smartcenter connections to the gateway via the LOM port. Maybee this is enough for your requirements.

Wolfgang

 

View solution in original post

0 Kudos
Highlighted
Contributor

This is how I achieved this with PBR, the "real default route" is pointing to another interface. 

set pbr table Mgmt static-route default nexthop gateway address 10.10.10.1 priority 1


set pbr rule priority 10 match from 10.10.10.0/24 to 10.10.10.0/24
set pbr rule priority 20 match from 10.10.10.0/24 to 10.0.0.0/8
set pbr rule priority 20 action table Mgmt
set pbr rule priority 30 match from 10.10.10.0/24 to 172.16.0.0/12
set pbr rule priority 30 action table Mgmt

View solution in original post

11 Replies
Highlighted

Maybe I don't understand something here, but it looks that just a proper routing is required.

Mgmt interface should be available from specific hosts or networks for management purposes. So, rotes to these networks should point through Mgmt interface. And default gateway stays where it is now for other traffic. Mgmt interface doesn't have a separate routing domain, it is the same interface, as other on the device.

0 Kudos
Highlighted
Collaborator

I need Saperate routing domain for Mangement interface and then i will apply default route for dedicate mangement interface and after that it can communicate with another vlan also

 

and This management interface subnet should not showing in main routing interface like

directly connected

Harmesh Yadav
0 Kudos
Highlighted
Leader
Leader

As Aleksey wrote, there is no own routing instance for the management interface and this interface works same like any other.

To reach other subnets in your management VLANs you can configure routes going out via the management interface. And you can limit the connections via the rulebase.

But if you have to physical seperate you have to use another solution...

Another option will be to use VSX (if it is supported on your appliance and you have the license). With this you can put your management completly an a seperate network and run your firewall as an virtual system with no connectivity to the management.

And additional you have on most of the larger appliances a LOM card which you could connect to the management VLAN.

But you can use the LOM port only to connect to the console of the appliance, It is not possible to have smartcenter connections to the gateway via the LOM port. Maybee this is enough for your requirements.

Wolfgang

 

View solution in original post

0 Kudos
Highlighted
Collaborator

Actaully from LOM we can get direct console which will be console Cli by Java plugin

 

Gaia OS GUI and SSH is accessible from LOM port ?

Harmesh Yadav
0 Kudos
Highlighted
Leader
Leader

"Gaia OS GUI and SSH is accessible from LOM port"

simple answer, NO.

Access is only possible to the console like if you are connected via the ConsolePort.

0 Kudos
Highlighted
Contributor
 
0 Kudos
Highlighted
Contributor

This is a pain I had multiple times when migration from VSX.

 

I managed to solve it with a PBR, any traffic originated from the mgmt IP is sent to a different PBR table which has a different default route.

Just need to create a bypass rule for traffic within the local network of the management.

Highlighted
Collaborator

I have open ticket with checkpoint support they told me this will be not possible

 

Checkpoint Should give this feature ,

Harmesh Yadav
Highlighted

This is coming with R80.30: Management Data Plane Separation (sk138672)

Highlighted
Contributor

This is how I achieved this with PBR, the "real default route" is pointing to another interface. 

set pbr table Mgmt static-route default nexthop gateway address 10.10.10.1 priority 1


set pbr rule priority 10 match from 10.10.10.0/24 to 10.10.10.0/24
set pbr rule priority 20 match from 10.10.10.0/24 to 10.0.0.0/8
set pbr rule priority 20 action table Mgmt
set pbr rule priority 30 match from 10.10.10.0/24 to 172.16.0.0/12
set pbr rule priority 30 action table Mgmt

View solution in original post

Highlighted
Collaborator

yes,I voted for Harmesh.

Which called by other vendors "virtual-router" is needed.

0 Kudos