Policy based routing

[az26]

Hi,

I’d like to ask for some advice regarding Policy-Based Routing (PBR), specifically whether using PBR can consume a significant amount of RAM and CPU on a Check Point firewall.

I have a ClusterXL setup (no VSX and no Multi-Domain Management), and we are going to have 2 different public subnets from the same ISP.

I have thought of 2 solutions on how to implement a setup where the 2 public subnets can be used simultaneously. 

1. Use the normal default route for all traffic and PBR for the second public subnet
The first public subnet would use the normal Internet routing configuration. For traffic originating from the second public subnet, or from specific private subnets, PBR would be used to route the traffic appropriately.

2- Use only one default route towards the internet and configure the second public subnet on a physical interface that's NOT facing the internet. I'll ask the ISP to configure a static route for the second public subnet pointing at link we already have with the first subnet. I have only one concern that is NATing for the second subnet, I think it should work with no problem.

Which setup you guys think is the best to be used in this case? and do you think NATing will work if I implement the second solution?

[PhoneBoy]

To answer the question of resource usage, it is generally not an issue unless your routing table is huge.
In general, you might want to have a look at: https://support.checkpoint.com/results/sk/sk167135 

[Chris_Atkinson]

It depends what you are trying to achieve and why, can you please clarify?

Do you have multiple links from the ISP or only multiple subnets, is there a reason you want traffic on different links etc?

[Duane_Toler]

Do you just want to use Subnet2 for NAT purposes? If so, that's easy; no PBR.  Just as you were imagining in your Item 2. You need to have your upstream next-hop gateway (aka "the thing that is your default gateway") unicast route Subnet2 to your cluster VIP:

# 192.0.2.0/24 is your Subnet2; 203.0.113.254 is your cluster VIP
# 203.0.113.0/24 is your current ISP-facing subnet; e.g.: 203.0.113.1 is your default gateway, this router
ip route 192.0.2.0 255.255.255.0 203.0.113.254

 Now just configure host/network objects with hide or static NAT as per usual. No ARPs to publish, no proxy arps to mangle.

The only reason "arp" and "proxy arp" are truly ever needed is to just get the packet into the host's OS interface for processing.  That's all these things really do; "give me the packet", they say.  Once the host OS has the packet, it does its normal packet-processing thing.  That's what the unicast route from the ISP uplink does; gives you the packet (that's how routers work anyway).

I've done this countless times on single gateway, cluster, and VSX VS.

For extra credit, ask yourself "can I use the network ID and broadcast IPs in this manner?"  (I'll leave that as an exercise for the reader).