Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
cstaffbrad
Explorer

Bgp does not Established when Standby become Active

 

4400 Next Generation Firewall HA Appliance
Cluster Mode HA (Active,Standby) R80.40 Take 118
Configuration in place a per sk108958

We have implemented Dynamic routing protocol
as per sk108958 but when Cluster-1 is in the active state, the bgp traffic is processed
according to the implicit rule 0. But when Cluster-2 became active,
I see bgp traffic being drop by rule 100.

The workaround is to create a rule and allow the bgp traffic rule
in order to have the bgp status in the established state.

The question now is why is BGP traffic handled with implicit rule
when cluster-1 is Active? and does not apply to cluster-2 when
this becomes active?

Is this specific BGP rule necessary? is this official solution ?
is it by design or is it a bug?

sk39960 explained how to allow bgp traffic
How to allow dynamic routing protocols (OSPF, BGP, PIM, RIP, IGRP) traffic through Check Point Security Gateway
If this is the right solution, then why is the bgp traffic handled by an implicit rule?

0 Kudos
9 Replies
PhoneBoy
Admin
Admin

What precise traffic is being allowed by the implicit rule on the primary versus an explicit rule on the secondary when it is active?

0 Kudos
cstaffbrad
Explorer

ImpliedRule.JPG

0 Kudos
Albin
Contributor

Looks like the traffic is sourced from the GW itself on the implied rule. Outgoing traffic is an implied rule.

Is the dropped traffic also sourced locally? That would be unexpected.

You need a BGP rule to accept the traffic for incoming BGP. 

cstaffbrad
Explorer

Yes, The Dropped traffic is also sourced locally.

0 Kudos
the_rock
Authority
Authority

@Albin gave a good explanation. Do you have an actual rule that would accept incoming BGP? Something for protocol 179?

0 Kudos
cstaffbrad
Explorer

I don't know if I understand your question correctly, but I think the description of the problem should answer your question.

"The workaround is to create a rule and allow the bgp traffic rule in order to have the bgp status in the established state. The question now is why is BGP traffic handled with implicit rule when cluster-1 is Active? and does not apply to cluster-2 when this becomes active?"

0 Kudos
the_rock
Authority
Authority

My bad, missed that part, sorry about that. Cant say I ever seen that before, does not make a whole lot of sense, since rule would apply to the cluster regardless. Im wondering, when member 2 is active, what does clish -c "show route bgp" show? Do you see all the BGP routes there like on member 1 that works?

0 Kudos
cstaffbrad
Explorer

No problem. Yes, I see BGP routes like 1 that works. 

0 Kudos
the_rock
Authority
Authority

I would probably open TAC case...I find that behavior very odd. Not sure if you tried rebooting  member 2 or not, but it might be worth a shot.

0 Kudos