P2P Config compatibility in Active/Standby Cluster

[SriNarasimha005]

Hi Experts,

We're planning to replace a Cisco ASA firewall with the Checkpoint firewalls which has P2P link connected. The requirement is that Checkpoint firewalls in HA (Active/Standby) should be able to support the P2P link configuration.

Below is the overview of the architecture. Is this a correct design?

Vendor Firewall (Source) -> P2P link -> Cisco Switches -> Checkpoint firewalls -> Application (Destination)

With regards to the ISP redundancy, I'm unable to find any in R81.X and the last one is related to R80.40 (ISP Redundancy on a Cluster)

1. I believe P2P link configuration is similar to the ISP redundancy. Is my understanding correct?

2. If yes, can you please let me know if the newer versions supports ISP Redundancy on a Cluster?

3. As described in the R80.40 documentation, I don't have any default route towards Internet to monitor the next hop IP. Rather, specific traffic is being allowed towards the core network from the vendor side with the return route. Is it a correct config/design to support ISP redundancy?

Thank you.

[PhoneBoy]

We don't support configuring PPPoE with ClusterXL: https://support.checkpoint.com/results/sk/sk101747
Also, ISP Redundancy usually involves multiple Internet connections with a default route.

[SriNarasimha005]

Hi @PhoneBoy 

Thanks for the information. Does it support on a checkpoint over a standalone firewall?

Please note that the links are getting connected to the switch as highlighted.

Thank you.

[the_rock]

Personally, I would get an official confirmation from your local SE and TAC.

[Chris_Atkinson]

Do you mean P2P in the context of OSPF configuration or something else?

[SriNarasimha005]

---

@Chris_Atkinson wrote:

Do you mean P2P in the context of OSPF configuration or something else?

---

This is P2P link and not related to OSPF

[the_rock]

As Phoneboy said, its PPPOE?

[SriNarasimha005]

Hi @the_rock @PhoneBoy 

Sorry for the confusion. P2P it's a wider term which has been used and it's not a PPPoE. It's a MPLS/Metro-E private link with RJ-45 ports, UTP cables being used.

With the attached design, I believe it'll automatically provide redundancy in the scenarios if any of the link/switch/firewall goes down. I'm happy to be corrected 😊

[the_rock]

Ah, point 2 point you mean 🙂

[emmap]

I think the short answer would be that we would recommend an alternate HA solution here, but would need a more complete understanding of the setup to fully settle on how to do it. Probably best to chat to your local sales office about options here.

[PhoneBoy]

Why wouldn't you just configure static routes for the relevant network(s) on both gateways in this case?
This would need to be done anyway to ensure that traffic doesn't get lost when a failover occurs on the cluster.

[the_rock]

Makes total sense.