cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

PBR With Multiple Tracking

Hi, how to configure PBR for redundancy automatic,i try Priority but not functioning.

Regards

19 Replies
Admin
Admin

Re: PBR With Multiple Tracking

A network diagram of what you're trying to do would be helpful.

0 Kudos

Re: PBR With Multiple Tracking

if you want to use two external connectivity and have an automatic backup if you loose one of them ( if I understand correctly) probably you need to implement ISP redundancy , policy base routing wont work in that way

0 Kudos

Re: PBR With Multiple Tracking

this is the diagram.

User A connect to internet to ISP A

User B connect to internet to ISP B

User C connect to internet to ISP C

When ISP A is down automatic failover to ISP B or ISP C configured with priority is not functioning.

0 Kudos
Admin
Admin

Re: PBR With Multiple Tracking

How would the gateway determine ISP A is down?

To do that, you'd need to have a reachability test (such as Ping)--something our PBR doesn't currently support.

0 Kudos
Highlighted

Re: PBR With Multiple Tracking

yes i understand, there is developed for coming soon pbr support this ?

0 Kudos
Admin
Admin

Re: PBR With Multiple Tracking

I believe it's planned, yes, but don't have an exact timeframe.

Re: PBR With Multiple Tracking

some date estimated for this ?

0 Kudos
Admin
Admin

Re: PBR With Multiple Tracking

It appears there is a customer-specific release that offers this functionality.

Please check with your Check Point office.

0 Kudos

Re: PBR With Multiple Tracking

i question for the specific release with Check Point Office and respond not exist this.

Regards

0 Kudos
Admin
Admin

Re: PBR With Multiple Tracking

Contact me privately with who you're working with.

I'll connect the dots on the backend.

0 Kudos

Re: PBR With Multiple Tracking

A little-known feature of ClusterXL may be able to help here; ClusterXL can be configured to test connectivity to upstream IP addresses with ping, and initiate a failover based on loss of reachability to the pinged hosts.  There could be a very different Gaia PBR configuration on the standby member that takes over as a result.  See:

sk35780: How to configure $FWDIR/bin/clusterXL_monitor_ips script to run automatically on Gaia / Sec...

"IPS Immersion Training" Self-paced Video Class
Now Available at http://www.maxpowerfirewalls.com
0 Kudos
Vladimir
Pearl

Re: PBR With Multiple Tracking

Tim,

According to sk100500:

PBR is supported in the following clusters:

  • ClusterXL High Availability
  • ClusterXL Load Sharing Unicast
  • ClusterXL Load Sharing Multicast
  • VRRP

Note:
PBR must be configured on each of the cluster members individually, and the configuration must be identical.

Can you shed some light if the above statement is correct or is it negated by the sk35780?

Re: PBR With Multiple Tracking

I'd say the later SK is probably more correct and the PBR configs should match.  I don't think ClusterXL will be able to actually tell if the PBR configuration is different between the cluster members (same way it can't tell if regular IP routing is different between them), but it may cause issues with how connections are represented between the members via state sync.  Trying a different PBR config between different cluster members will probably work but will most certainly not be supported.

"IPS Immersion Training" Self-paced Video Class
Now Available at http://www.maxpowerfirewalls.com

Re: PBR With Multiple Tracking

Hello! I have the same question! Is there any workaround for now? There past one year since first question..... How to achieve same functionality as on ip sla + track on cisco in PBR?????

Admin
Admin

Re: PBR With Multiple Tracking

Please check with your local office about the customer-specific release I mentioned.

0 Kudos
Admin
Admin

Re: PBR With Multiple Tracking

PBR with multiple ISPs is now supported from R80.30.
This is recommended versus using the customer releases previously mentioned.
0 Kudos
quanglnh
Ivory

Re: PBR With Multiple Tracking

Hi PhoneBoy,

 

I have a situation that need to use tracking host too. Let say from my Check Point Firewall, i have 2 connection to remote site. 1 is primary and 1 is backup. I want to track if primary connection are down (track by ping or something else) all connection to remote site will automaticly change to thê backup connection. And if primary connection up again, then all connections automaticly move back to primary connection. Can we do that with R80.10 or i have to upgrade to R80.30 ?

0 Kudos

Re: PBR With Multiple Tracking

@quanglnh You can do this with Multi Hop PBR from 80.30 onwards

https://www.linkedin.com/in/federicomeiners/
0 Kudos
quanglnh
Ivory

Re: PBR With Multiple Tracking

thanks Federico Meiners, I will check on this

0 Kudos