Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

PBR With Multiple Tracking

Hi, how to configure PBR for redundancy automatic,i try Priority but not functioning.

Regards

19 Replies
Highlighted
Admin
Admin

A network diagram of what you're trying to do would be helpful.

0 Kudos
Highlighted

if you want to use two external connectivity and have an automatic backup if you loose one of them ( if I understand correctly) probably you need to implement ISP redundancy , policy base routing wont work in that way

0 Kudos
Highlighted

this is the diagram.

User A connect to internet to ISP A

User B connect to internet to ISP B

User C connect to internet to ISP C

When ISP A is down automatic failover to ISP B or ISP C configured with priority is not functioning.

0 Kudos
Highlighted
Admin
Admin

How would the gateway determine ISP A is down?

To do that, you'd need to have a reachability test (such as Ping)--something our PBR doesn't currently support.

0 Kudos
Highlighted

yes i understand, there is developed for coming soon pbr support this ?

0 Kudos
Highlighted
Admin
Admin

I believe it's planned, yes, but don't have an exact timeframe.

some date estimated for this ?

0 Kudos
Highlighted
Admin
Admin

It appears there is a customer-specific release that offers this functionality.

Please check with your Check Point office.

0 Kudos
Highlighted

i question for the specific release with Check Point Office and respond not exist this.

Regards

0 Kudos
Highlighted
Admin
Admin

Contact me privately with who you're working with.

I'll connect the dots on the backend.

0 Kudos
Highlighted

A little-known feature of ClusterXL may be able to help here; ClusterXL can be configured to test connectivity to upstream IP addresses with ping, and initiate a failover based on loss of reachability to the pinged hosts.  There could be a very different Gaia PBR configuration on the standby member that takes over as a result.  See:

sk35780: How to configure $FWDIR/bin/clusterXL_monitor_ips script to run automatically on Gaia / Sec...

Book "Max Power 2020: Check Point Firewall Performance Optimization" Third Edition
Now Available at www.maxpowerfirewalls.com
0 Kudos
Highlighted
Pearl

Tim,

According to sk100500:

PBR is supported in the following clusters:

  • ClusterXL High Availability
  • ClusterXL Load Sharing Unicast
  • ClusterXL Load Sharing Multicast
  • VRRP

Note:
PBR must be configured on each of the cluster members individually, and the configuration must be identical.

Can you shed some light if the above statement is correct or is it negated by the sk35780?

Highlighted

I'd say the later SK is probably more correct and the PBR configs should match.  I don't think ClusterXL will be able to actually tell if the PBR configuration is different between the cluster members (same way it can't tell if regular IP routing is different between them), but it may cause issues with how connections are represented between the members via state sync.  Trying a different PBR config between different cluster members will probably work but will most certainly not be supported.

Book "Max Power 2020: Check Point Firewall Performance Optimization" Third Edition
Now Available at www.maxpowerfirewalls.com
Highlighted

Hello! I have the same question! Is there any workaround for now? There past one year since first question..... How to achieve same functionality as on ip sla + track on cisco in PBR?????

Highlighted
Admin
Admin

Please check with your local office about the customer-specific release I mentioned.

0 Kudos
Highlighted
Admin
Admin

PBR with multiple ISPs is now supported from R80.30.
This is recommended versus using the customer releases previously mentioned.
0 Kudos
Highlighted
Iron

Hi PhoneBoy,

 

I have a situation that need to use tracking host too. Let say from my Check Point Firewall, i have 2 connection to remote site. 1 is primary and 1 is backup. I want to track if primary connection are down (track by ping or something else) all connection to remote site will automaticly change to thê backup connection. And if primary connection up again, then all connections automaticly move back to primary connection. Can we do that with R80.10 or i have to upgrade to R80.30 ?

0 Kudos
Highlighted

@quanglnh You can do this with Multi Hop PBR from 80.30 onwards

____________
https://www.linkedin.com/in/federicomeiners/
0 Kudos
Highlighted
Iron

thanks Federico Meiners, I will check on this

0 Kudos