BGP sessions under the same VLAN

[jesussantiago01]

Currently, a Checkpoint firewall is being managed in which I have a VLAN to Azure. Currently, I want the Checkpoint gateway devices to receive two BGP sessions under the same VLAN ID. Would this be possible? Thank you for your help.

[Chris_Atkinson]

For peers on different subnets correct, is this a cluster?

Other scenarios where this has been achieved VLAN mapping or VLAN translation is used on the intermediate switch.

[jesussantiago01]

Yes, that is correct. Both BGP peers are on different /30 subnets, but they are delivered over the same VLAN ID by Azure ExpressRoute.

And yes, this is a Check Point cluster (ClusterXL in HA mode). The challenge is that Azure provides two separate /30 peerings on a single VLAN, while Check Point does not seem to support configuring multiple IP networks on the same VLAN interface in a cluster.

Can you please confirm if there is any supported method on Check Point to handle this scenario, or if the only option is to implement VLAN mapping/translation on the intermediate switch to separate each /30 into different VLANs before reaching the firewalls?

[PhoneBoy]

This is a long-standing limitation of ClusterXL: https://support.checkpoint.com/results/sk/sk31821
Which means you'll have to translate the VLANs somehow.

[soc_fenix]

Currently, a Checkpoint firewall is being managed in which I have a VLAN to Azure. Currently, I want the Checkpoint gateway devices to receive two BGP sessions under the same VLAN ID. Would this be possible?

Thank you for your help.

[Chris_Atkinson]

I have merged your thread with this existing one.