PBR Behavior for Gaia WebUI

[Yeti]

Without having a separate VRF for Management traffic I have added PBR rules to facilitate this for the Management interface which is connected to a downstream router that does the L3 routing for Internal networks.   It is a simple PBR matching the source IP of the Management interface 10.254.254.61 and the 10.253.253.0/24 destination network where a client would be sourcing Management traffic ( HTTPS,SSH)  The action table is also simple where the route back to the 10.253.253.0/24 destination network has next hop gateway IP 10.254.254.1 of the downstream router that the Checkpoint Management interface is connected to ( out-of-band from normal data traffic ).  Of course there is a more generic route configured on the firewall for the internal private IP subnets pointing to the downstream router on a separate transit interface.  The interesting part is that SSH management traffic gets routed appropriately via the PBR, so traffic ingresses the  Management interface and egresses the Management interface.  However management Gaia Webui 443 traffic does NOT seem to follow the PBR, instead the traffic ingresses the Management interface and egresses the transit interface with the more generic route.  I have verified the traffic flows via fw monitor and disabled/enabled SecureXL just to make sure.  The PBR does not define service ports.  Any ideas?  

R81.10 T110 on 6400 Cluster

[Chris_Atkinson · Accepted solution]

"Locally-generated traffic" is a PBR limitation per sk167135.

VSX or MDPS may help achieve the separation that you desire.

[Yeti]

I did review this SK but wasn't sure if this particular scenario is considered as locally generated as the session is sourced outside of the firewall.  Any reasons for only SSH working ?

[Luis_Miguel_Mig]

Is there any plan to resolve the Local-generated traffic  limitation?

[PhoneBoy]

I recommend approaching your local Check Point office with an RFE if this is needed.