Add a second Internet connection on 3600 Gaia OS R81.20

[LM-Rafael]

Hello,

i have a quantum 3600 gateway with 2 internet connections:

1. Connection -> Directly connected over an VDSL Modem

2. Connection -> Over an Router (Gateway 10.0.1.1) and on Check Point 3600 is connected to interface eth1 with the ip: 10.0.1.2

I have check all points but the connection still not working. What are the steps to configure a second Internet connection which is running over an router? With pppoe it was no problem!

I need out help.

Thanks and BR

Rafael

[AkosBakos]

Hi @LM-Rafael 

There are solution which name is ISP redundancy. This would be my first advise:

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Quantum_SecurityGateway_Guid...

It works, and not a rocket science.

If you want to use the second link as indiviual link:

• this Interface is configured as "external"
• what about the routing?
  • is there a route which point to this path?

Akos

[Chris_Atkinson]

Is your issue specific to the use of SDWAN or adding / setup of the second internet connection in general?

[the_rock]

I would follow that exact link @AkosBakos provided. Its been some time since I did this, but it is very straight forward. As long as routes are correct, when you click the option to get a route, something should populate. Howveer, if it does NOT, then you have to check the routes.

Andy

[AmirArama]

can you please define the issue in more detail?

when you say the connection is not working, what do you mean?

do you have ping to the next hop router? if not, do you see it in 'arp -an' ? if not, check your IP configuration on both sites, cable, etc.

if you have connectivity to the router, but not to the internet through it? how exactly do you check it?

did you change the default gateway to be the new next hop router and removed the old one? (don't do that remotely).

you can configure specific route like:

clish > 'set static-route 9.9.9.9/32 nexthop gateway address 10.0.1.1 on'

and then try to ping 9.9.9.9 from the GW, if it doesn't work, first check that the connection goes out by tcpdump -nnei 'ethX' host 9.9.9.9, if you see that the connection leave the GW through the correct interface but no reply (on tcpdump), check if your router or ISP applies source NAT on that connection from your IP, or not blocking it. etc.

if you don't see it goes out from the interface with tcpdump, it might getting dropped on the GW (did you configure the second link in SMC > GW object > network management  > get interface)

if you see it goes out, and you also see the reply on that interface by tcpdump, but still no reply on the ping, it could be that the reply is dropped. (check your anti spoofing configuration on the GW, or just run 'fw ctl zdebug + drop' to see the drop reason)

if it's working from your GW, but not from your network behind the GW, make sure you have automatic hide NAT with 'hide behind gw' on the internal network object. and the traffic is not dropped (you can use the above commands to check the traffic)

after you got this working, you can consider Quantum SD-WAN with Local breakout / ISP Redundancy, or simple PBRs or routes to distribute the traffic across the different ISPs.

Thanks