Static routing not working after policy install

[HristoGrigorov]

Hi,

Is anyone able to easily confirm this?

1. Have two ISP connections: ISP-A and ISP-B configured in HA mode.

2. Add following static routes:

src: 192.168.0.0/24 via ISP-B, metric:10

src: 192.168.0.0/24 via ISP-A, metric: 20

3. Observe static routing works fine and outgoing connections pass through ISP-B. 

4. Do just any change and install policy.

5. Observe static routing no longer works and in fact outgoing traffic is stuck and does not go through either of the ISP connections.

[PhoneBoy]

What appliance and code version?

How did you configure the ISP redundancy?

[HristoGrigorov]

Thanx and sorry, forgot to mention it:

This is Check Point's 1470 Appliance R77.20.80 - Build 437

and

ISP redundancy is in High-Availability mode with ISP-A being Primary and the other Secondary. Both ISPs are sharing same WAN interface using VLANs.

[PhoneBoy]

The other relevant question: locally managed or via external security management?

Based on what you're describing it seems like latter.

Also, is it all traffic going out 192.168.0.0/24 that fails after a policy push?

[HristoGrigorov]

Yes, centrally managed. Only traffic that is supposed to go out through WAN interface fails. Other (internal) traffic works fine.

[PhoneBoy]

Is it ALL WAN traffic or just traffic destined for 192.168.0.0/24?

Either way, this seems like a bug and you should open a TAC caseso we can collect the appropriate Troubleshooting.

[HristoGrigorov]

It is outgoing routing, so only traffic from 192.168.0.0/24 to WAN is not working. I wanted quick confirm from someone else before I engage TAC because it all seem kind of peculiar to me and I am not sure if problem is not something I am doing wrong.

[Maarten_Sjouw]

Have you tried using the actual IP of the IPS-A and ISP-B gateways instead of the ISP-A or B setting?

[HristoGrigorov]

Thanx for the suggestion. I tried it but unfortunately end result is the same. What I noticed however is that there is still connectivity, I can telnet for example to port 80 or 443. So it must be some of the AC/UF blades that is failing.

[HristoGrigorov]

I have opened SR now and we are investigating it together with TAC. I will demand fix for this because it is the only way to have working SecureXL and still utilize secondary ISP somehow. Even though it is a manual way to do it.

Will update when there is a progress...