Policy based routing

[az26]

Hi,

I’d like to ask for some advice regarding Policy-Based Routing (PBR), specifically whether using PBR can consume a significant amount of RAM and CPU on a Check Point firewall.

I have a ClusterXL setup (no VSX and no Multi-Domain Management), and we are going to have 2 different public subnets from the same ISP.

I have thought of 2 solutions on how to implement a setup where the 2 public subnets can be used simultaneously. 

1. Use the normal default route for all traffic and PBR for the second public subnet
The first public subnet would use the normal Internet routing configuration. For traffic originating from the second public subnet, or from specific private subnets, PBR would be used to route the traffic appropriately.

2- Use only one default route towards the internet and configure the second public subnet on a physical interface that's NOT facing the internet. I'll ask the ISP to configure a static route for the second public subnet pointing at link we already have with the first subnet. I have only one concern that is NATing for the second subnet, I think it should work with no problem.

Which setup you guys think is the best to be used in this case? and do you think NATing will work if I implement the second solution?

[PhoneBoy]

To answer the question of resource usage, it is generally not an issue unless your routing table is huge.
In general, you might want to have a look at: https://support.checkpoint.com/results/sk/sk167135 

[Chris_Atkinson]

It depends what you are trying to achieve and why, can you please clarify?

Do you have multiple links from the ISP or only multiple subnets, is there a reason you want traffic on different links etc?

[Duane_Toler]

Do you just want to use Subnet2 for NAT purposes? If so, that's easy; no PBR.  Just as you were imagining in your Item 2. You need to have your upstream next-hop gateway (aka "the thing that is your default gateway") unicast route Subnet2 to your cluster VIP:

# 192.0.2.0/24 is your Subnet2; 203.0.113.254 is your cluster VIP
# 203.0.113.0/24 is your current ISP-facing subnet; e.g.: 203.0.113.1 is your default gateway, this router
ip route 192.0.2.0 255.255.255.0 203.0.113.254

 Now just configure host/network objects with hide or static NAT as per usual. No ARPs to publish, no proxy arps to mangle.

The only reason "arp" and "proxy arp" are truly ever needed is to just get the packet into the host's OS interface for processing.  That's all these things really do; "give me the packet", they say.  Once the host OS has the packet, it does its normal packet-processing thing.  That's what the unicast route from the ISP uplink does; gives you the packet (that's how routers work anyway).

I've done this countless times on single gateway, cluster, and VSX VS.

For extra credit, ask yourself "can I use the network ID and broadcast IPs in this manner?"  (I'll leave that as an exercise for the reader).

[az26]

Thanks Duane for your reply! 
We have a public subnet, let's say 203.0.113.0/24
We have 2 internet connections, each one is terminated to a Security GW. One internet connection is primary while the second one is secondary. We have outgoing traffic, we have NATing (in and out),, etc.
Everything is working fine. 

Now we have a new daughter company to integrate into our network. They have their own public subnet, let's say 192.0.2.0/24.
They want to keep their public subnet mainly for the NATed objects in the DMZ, i.e. their public servers that should be reached from the internet.
They don't have any requirement about their outgoing traffic, so we can use either public subnet. 

In your answer, do you mean that we don't even need to configure an interface the subnet-2 ?
Then, all traffic goes over the existing links that use 203.0.113.0/24 ?
We'll of course ask the ISP to configure a static route in the CPEs toward 192.0.2.0/24 pointing at 203.0.113.254 as you wrote.

[Duane_Toler]

(Full Disclosure: *hand-waving*/*glossing-over* some finer details)
Yes, that should work.

Speaking of those finer details:

However, if both ISPs are terminating directly into your gateways, what is the determining factor that gets the additional subnet down each ISP path?  (or do you just need it down one path?) Who/what is advertising ownership of that additional subnet? Do you have (or need) BGP on your firewall to announce that subnet? This will be the part where it can go wrong.

Regardless: depending on your size and need, you can get, or make, yourself a way to test/lab this to verify everything first. Shouldn't take too much time.

[az26]

Thanks a lot Duane!
I'll test this in the lab and I'll you know if something doesn't go as suggested 🙂 

We own our public subnet.
At the moment we are using static routing. We have 2 internet connections from the same ISP. 
The plan is to ask our ISP to announce subnet-2 (daughter company public subnet). 

[Duane_Toler]

Ah! Hand-waving and details probably aren't warranted. Give it a test and you should be in business.