This content is quoted (and slightly modified to directly answer your questions) from the Check Point Certified Maestro Expert (CCME) class which just received an update supplement for R81.20:
Fast Forward (FF) cannot be configured for systems located on any directly attached subnets of the Security Group, there must be a next hop router to reach all sources *and* destinations configured in FF rules. This limitation is to prevent excessive caching of MAC/hardware addresses on the MHO itself.
For TCP connections that are configured for Fast Forwarding, only the TCP SYN and SYN/ACK are forwarded to a member of the Security Group for an action of Accept, which ensures a log is created for the TCP connection as well as determining routing for the lifetime of the connection. All subsequent packets of the TCP connection are forwarded directly by the MHO based on that initial routing and not inspected further; because of this behavior if dynamic routing is in use on the gateway and the routing for the previously FF'ed connection changes, the routing will not be updated on the MHO. So in that specific case the FF'ed connection may stop working (or it may not if the initial routing determined is still functional, but perhaps it is no longer the "optimal" route), which is why Dynamic Routing is not supported for use with FF. But it may still work, maybe.
Be aware that logs are not created at all for UDP and IP Protocol services (i.e. GRE, ESP, etc) matching Fast Forward rules, because these connections are forwarded by the MHO right from the first packet of the session.
Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
.png "Wolfgang"){kind=avatar}
