PBR With Multiple Tracking

[Jesus_Vladimir_]

Hi, how to configure PBR for redundancy automatic,i try Priority but not functioning.

Regards

[PhoneBoy]

A network diagram of what you're trying to do would be helpful.

[Marco_Valenti]

if you want to use two external connectivity and have an automatic backup if you loose one of them ( if I understand correctly) probably you need to implement ISP redundancy , policy base routing wont work in that way

[Jesus_Vladimir_]

this is the diagram.

User A connect to internet to ISP A

User B connect to internet to ISP B

User C connect to internet to ISP C

When ISP A is down automatic failover to ISP B or ISP C configured with priority is not functioning.

[PhoneBoy]

How would the gateway determine ISP A is down?

To do that, you'd need to have a reachability test (such as Ping)--something our PBR doesn't currently support.

[Jesus_Vladimir_]

yes i understand, there is developed for coming soon pbr support this ?

[PhoneBoy]

I believe it's planned, yes, but don't have an exact timeframe.

[Jesus_Vladimir_]

some date estimated for this ?

[PhoneBoy]

It appears there is a customer-specific release that offers this functionality.

Please check with your Check Point office.

[Jesus_Vladimir_]

i question for the specific release with Check Point Office and respond not exist this.

Regards

[PhoneBoy]

Contact me privately with who you're working with.

I'll connect the dots on the backend.

[Timothy_Hall]

A little-known feature of ClusterXL may be able to help here; ClusterXL can be configured to test connectivity to upstream IP addresses with ping, and initiate a failover based on loss of reachability to the pinged hosts.  There could be a very different Gaia PBR configuration on the standby member that takes over as a result.  See:

sk35780: How to configure $FWDIR/bin/clusterXL_monitor_ips script to run automatically on Gaia / Sec...

[Vladimir]

Tim,

According to sk100500:

PBR is supported in the following clusters:

• ClusterXL High Availability
• ClusterXL Load Sharing Unicast
• ClusterXL Load Sharing Multicast
• VRRP

Note:
PBR must be configured on each of the cluster members individually, and the configuration must be identical.

Can you shed some light if the above statement is correct or is it negated by the sk35780?

[Timothy_Hall]

I'd say the later SK is probably more correct and the PBR configs should match.  I don't think ClusterXL will be able to actually tell if the PBR configuration is different between the cluster members (same way it can't tell if regular IP routing is different between them), but it may cause issues with how connections are represented between the members via state sync.  Trying a different PBR config between different cluster members will probably work but will most certainly not be supported.

[Tolchenov_Maksi]

Hello! I have the same question! Is there any workaround for now? There past one year since first question..... How to achieve same functionality as on ip sla + track on cisco in PBR?????

[PhoneBoy]

Please check with your local office about the customer-specific release I mentioned.

[PhoneBoy]

PBR with multiple ISPs is now supported from R80.30.
This is recommended versus using the customer releases previously mentioned.

[quanglnh]

Hi PhoneBoy,

I have a situation that need to use tracking host too. Let say from my Check Point Firewall, i have 2 connection to remote site. 1 is primary and 1 is backup. I want to track if primary connection are down (track by ping or something else) all connection to remote site will automaticly change to thê backup connection. And if primary connection up again, then all connections automaticly move back to primary connection. Can we do that with R80.10 or i have to upgrade to R80.30 ?

[FedericoMeiners · Accepted solution]

@quanglnh You can do this with Multi Hop PBR from 80.30 onwards

[FedericoMeiners · Accepted solution]

@quanglnh You can do this with Multi Hop PBR from 80.30 onwards

[quanglnh]

thanks Federico Meiners, I will check on this

[RBS56505]

Hello Federico,

How would NAT work in such situation ?

Can we have 2 Hide NAT configured if we have 2 ISP links ?

And let PBR use corresponding external interface IP for NAT'g ?

[jesusarteria]

Hi Federico,

Do you have some scripts for example?

Regards

Yisus