Route outgoing traffic over specific ISP interface

[IronMan]

Hi experts,

I would like to share my issue here, no solution found yet even though it's a basic firewall function.

So i have 2 ISPs with one interface each on my Quantum Spark 1600, let's say ISP1 and ISP2.

I would like to split some of the outgoing traffic coming from the LAN to the internet, as specified websites would be accessed via ISP1 and all other websites via ISP2.

Now, on any other firewall i would create a firewall outbound rule with Name (Access some Websites via ISP1), Source (Any), Destination (microsoft.com, for example), Service/port (Http/https), Action (Allow, NAT or gateway ISP1)

But how to do that on the CP?

[AkosBakos]

Hi @IronMan 

I think URL filtering can be one solution. You create a policy as you mentioned on another FW and will work. But in this scenario the IFs don’t take part in the rule (as by other firewalls). Maybe you can create different NAT rules, eg microsoft would go in ISP1….. will be NATed on the ISP1’s IP

If I understood correct, you want to route the traffic on to ISPs link through depending on the destination (as basic load balancing solution between the 2 links)   In this case maybe Policy Based Routing can help, but determinate the destination could be hard.

The seniors will correct me, but there is no out-of-box solution, for load-balancig.

And here is a thread about ISP redundancy

https://community.checkpoint.com/t5/SMB-Gateways-Spark/PBRs-and-ISP-redundancy-on-SMB-appliances/td-...

akos

[IronMan]

PBR's won't be a solution for me, cause they work on an IP base, and what i need is a hostname base, which can be a bunch of IP's (for example microsoft.com, subdomain1.microsoft.com, subdomain2.microsoft.com would all have different IP's) so it would be a very hard if not impossible task to create PBR's for all of them. In other firewall solution i would just make *microsoft.com/* as a destination. You also specified NAT rules - i didn't find a way to achieve my goal through NAT rules.

[D_W]

Application Based Routing  might be what you're looking for. But I do not know if this is possible with SMB Devices (+locally managed).

[IronMan]

I will dig into that later, thank you for the hint

[Chris_Atkinson]

Have you attempted to configure the SD-WAN policy / steering objects per your use case?

[IronMan]

I heard about this new SD-WAN feature, the thing is it's coming in the latest firmware, but for now we have been told there are some issues with the latest firmware, so we decided to wait a bit for a fixed one.

[Chris_Atkinson]

For reference it's available both in the current recommended release (R81.10.10) and the latest (R81.10.15)

[AkosBakos]

Hi @IronMan 

True, the SD-WAN is available in R81.10.10. 

https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Content/Topics/SD-W...

This would be the best solution. 

Akos

[IronMan]

81.10.10 - that is the bugged version of what we've heard. I will give it a try with 81.10.15 probably (a very fresh version btw, only a few days ago released), will update this topic in a few days. Thank you