Check Point BGP ecmp load balancing with NAT Zone policy in R80.40??

[Wing_Chow]

Hi All, 

I'd like to know if this features will be available in R80.40, because i have been tested my needs in my infrastructure and i cannot work with this.

Please helps for customers, because like Palo Alto Networks working very well.

I always prefer Check Point and i am very disappointment that Check Point do not have this features.

Any information, please let me know if in R80.40 will include that. And also if Check Point will add a load balancer add-on in Software Blades will be the greatest ever NGFW.

Regards,

[Chris_Atkinson]

Hi
Can you please describe the use case scenario further?

Check Point already supports:
- NAT*
- Zone based policy (sk128572)
- BGP ECMP (sk100504)

Whilst "zone" objects can't currently be used in the NAT policy there are alternatives that may apply.

[Wing_Chow]

Hi Chris_Atkinson,

This is my scenario:

I have been configuring the best way to BGP ECMP Load Balancing (It is working at least with the same Weight of Route) but in my case the NAT for both 186.100.120.33 and 165.100.120.33 that i was published in the AS 30 and AS 20, i need to Load Balance the Manual NAT configured for those App Server.

I've tried the script for outbound NAT in ISP Load Sharing with Dynamic Objects (SK). (This is not my scenario because i am not using ISP Interfaces Load Balancing, in my case the Load Balancing is for BGP with ECMP and i need a NAT Zone for Load Balancing changing Dynamic source for Outbound Traffic).

# Verify which link is up with this command: tail -f /tmp/cpisp_state
echo "--------------------------" >> /tmp/cpisp_state
echo `/bin/date +%d-%b-%Y_%Hh-%Mm-%Ss` >> /tmp/cpisp_state
echo "RESTARTING SCRIPT" >> /tmp/cpisp_state
echo "LINK1" >> /tmp/cpisp_state
echo $LINK1_STATE >> /tmp/cpisp_state
echo "LINK2" >> /tmp/cpisp_state
echo $LINK2_STATE >> /tmp/cpisp_state
echo "--------------------------" >> /tmp/cpisp_state
echo " " >> /tmp/cpisp_state
# Check if the Link is up or down
if ($LINK2_STATE == "down") then
fw tab -t dynobj_cache -x -y
dynamic_objects -o DYN_ISP1 -r 0.0.0.0 255.255.255.255 -a
dynamic_objects -o DYN_ISP2 -r 0.0.0.0 255.255.255.255 -d
dynamic_objects -o DYN_ISP2 -r 0.0.0.0 0.0.0.0 -a
endif
if ($LINK1_STATE == "down") then
fw tab -t dynobj_cache -x -y
dynamic_objects -o DYN_ISP2 -r 0.0.0.0 255.255.255.255 -a
dynamic_objects -o DYN_ISP1 -r 0.0.0.0 255.255.255.255 -d
dynamic_objects -o DYN_ISP1 -r 0.0.0.0 0.0.0.0 -a
endif
# if both Links are up, return to Load Sharing
if (($LINK1_STATE == "up") && ($LINK2_STATE == "up")) then
fw tab -t dynobj_cache -x -y
dynamic_objects -o DYN_ISP1 -r 0.0.0.0 255.255.255.255 -a
dynamic_objects -o DYN_ISP2 -r 0.0.0.0 255.255.255.255 -a
endif

The questions is what can i do to have the same of similar performance as Palo Alto Networks:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClF8CAK

Any information for this feature or similar performance please let me know.

Regards,

[PhoneBoy]

The features planned for R80.40 are listed in the EA announcement: https://community.checkpoint.com/t5/General-Topics/R80-40-Early-Availability-Program-Check-Point-Upd...
As far as I know, NAT using Zones is not planned for R80.40.
Understanding your exact use case would be helpful.

[Wing_Chow]

Hi  PhoneBoy

This is my scenario:

I have been configuring the best way to BGP ECMP Load Balancing (It is working at least with the same Weight of Route) but in my case the NAT for both 186.100.120.33 and 165.100.120.33 that i was published in the AS 30 and AS 20, i need to Load Balance the Manual NAT configured for those App Server.

I've tried the script for outbound NAT in ISP Load Sharing with Dynamic Objects (SK). (This is not my scenario because i am not using ISP Interfaces Load Balancing, in my case the Load Balancing is for BGP with ECMP and i need a NAT Zone for Load Balancing changing Dynamic source for Outbound Traffic).

# Verify which link is up with this command: tail -f /tmp/cpisp_state
echo "--------------------------" >> /tmp/cpisp_state
echo `/bin/date +%d-%b-%Y_%Hh-%Mm-%Ss` >> /tmp/cpisp_state
echo "RESTARTING SCRIPT" >> /tmp/cpisp_state
echo "LINK1" >> /tmp/cpisp_state
echo $LINK1_STATE >> /tmp/cpisp_state
echo "LINK2" >> /tmp/cpisp_state
echo $LINK2_STATE >> /tmp/cpisp_state
echo "--------------------------" >> /tmp/cpisp_state
echo " " >> /tmp/cpisp_state
# Check if the Link is up or down
if ($LINK2_STATE == "down") then
fw tab -t dynobj_cache -x -y
dynamic_objects -o DYN_ISP1 -r 0.0.0.0 255.255.255.255 -a
dynamic_objects -o DYN_ISP2 -r 0.0.0.0 255.255.255.255 -d
dynamic_objects -o DYN_ISP2 -r 0.0.0.0 0.0.0.0 -a
endif
if ($LINK1_STATE == "down") then
fw tab -t dynobj_cache -x -y
dynamic_objects -o DYN_ISP2 -r 0.0.0.0 255.255.255.255 -a
dynamic_objects -o DYN_ISP1 -r 0.0.0.0 255.255.255.255 -d
dynamic_objects -o DYN_ISP1 -r 0.0.0.0 0.0.0.0 -a
endif
# if both Links are up, return to Load Sharing
if (($LINK1_STATE == "up") && ($LINK2_STATE == "up")) then
fw tab -t dynobj_cache -x -y
dynamic_objects -o DYN_ISP1 -r 0.0.0.0 255.255.255.255 -a
dynamic_objects -o DYN_ISP2 -r 0.0.0.0 255.255.255.255 -a
endif

The questions is what can i do to have the same of similar performance as Palo Alto Networks:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClF8CAK

Any information for this feature or similar performance please let me know.

Regards,

[Chris_Atkinson]

Thanks I understand why without additional routers or ISP independent address space to improve the design that this is a challenge for you.