Centrally Managed Spark: SD-WAN and IoT services

[perfect4situa]

Hi everyone,

I've got a ClusterXL made of two Spark 2000, 3 ISP configured, and all of this is Centrally Managed via Smart-1 Cloud.

Can someone explain if there is any way to configure SD-WAN and IoT protection for free as per Spark appliances Locally Managed?

I can't understand why these services are free to use in a Locally Managed mode and seems to be available only via licence purchase in Centrally Managed mode.

In case this is only available via license may I configure SD-WAN-similar result with static routes for example to redirect all the traffic from one network to a specific ISP or traffic for specific service via specific ISP?

Thank you

[Chris_Atkinson · Accepted solution]

sk178604 describes / categorises the difference as SMB vs Enterprise.

Presuming Spark management isn't an option, some of what you describe might be possible with PBR for basic cases.

[perfect4situa]

Thank you Chris, I'll try ASAP with a route and if it will work, I'll mark as solution

[perfect4situa]

Hi Chris with my tries I find out that two routes different only in network source and with next hop the same internet connection became static(PBR) and static only. I really don't now why. They seem to work but no correct failover on the default route in case of failure of secondary internet connection in the route.

I'm tryng monitoring the routes but there no clear explanation about the result and at the moment I can't verify if it's working or not...

[Chris_Atkinson]

What you need is something like what is described here but might not exist for Spark:

https://community.checkpoint.com/t5/Security-Gateways/Path-Monitoring-for-Policy-Based-Routing/td-p/...

Failing that I see little choice but to leverage proper SD-WAN license.

[perfect4situa]

In Spark there isn't the option to set pbr... It seems also the monitoring system really don't work. Is there a way to view low-level log about this? I only got this...

 

[RS_Daniel]

Hi,

If you want the routes to failover automatically, your next hope must be defined using interface, not IP address. Also you connection monitoring must be configured and working properly on your 3 ISP interfaces.

Connection monitoring is a bit tricky i think. For this monitoring consider: Each ISP should monitor different IP address (dns did not work very well for me), each IP address you monitor should have a static route for that corresponding ISP. For example: ISP-1 monitors 8.8.8.8, you should have a static route for 8.8.8.8 using next hope IP address the default gateway for that ISP, it should not failover in case ISP-1 goes down or the monitoring will flap.

Regards

[perfect4situa]

In addition to this I'd like to share an update:

- after latest firmware version (81.10.17) internet monitoring starts working correctly (still some problems with pppoe in cluster deployment)

- with internet monitoring working and static route (pbr) the traffic correctly go trough the right selected and in case of wan failure the route became disabled and the eventually default wan available became the gateway for the pbr network

[Chris_Atkinson]

Per sk101747 Pppoe is not supported with a cluster in general however sk181841 suggests there might be an option with Spark that suits some limited scenarios perhaps.

[G_W_Albrecht]

We speak of two different SD-WAN blades with different features. Locally and Spark Portal Managed SMBs have SD-WAN for SMBs blade, while centrally managed have the SD-WAN for Enterprise blade (like GAiA GWs) including e.g. VPN overlay. Find more details in https://support.checkpoint.com/results/sk/sk180605