Cascading interface faiilure

[Michael_Horne]

Hello All,

Is it possible to cascade link failure form one interface to another.  If the Internet facing link fails, then we want to take down a specific interface on the Check Point gateway. When the Internet facing link comes up, then the specific interface is reactivated.  There are monitored IPs, but there seems no way to link the status of an interface to a monitored IP.

We are looking at if Check Point can replace Fortinet for particular customer and this is one feature the Fortinet has, that I cannot find a similar feature for on the Checkpoint.

The Fortinet feature is the following, if Port3 goes down then Port 4 is also shutdown. 

It woudl be possible with a script that is running periodically on the gateway, but a customized script is something that the customer would feel comfortable supporting.

Many thanks,

Michael

[Chris_Atkinson]

Is there dynamic routing used in this environment?

If the interfaces are bridged you have the option of Link State Propagation:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Installation_and_Upgrade_Guide/Top...

[Michael_Horne]

Hello Chris,

The FW is running in routed mode.  

Regards,

Michael

[Timothy_Hall]

If you are using ClusterXL you can adapt the clusterXL_monitor_ips script to do what you want.  sk92904: How to configure $FWDIR/bin/clusterXL_monitor_process script to run automatically on Gaia /...

This script is used to ping an IP address and then issue a pnote when the IP no longer responds, thus causing a failover.  Replace the following lines in the script:

$FWDIR/bin/cphaconf set_pnote -d host_monitor -t 0 -s ok register -----> Comment out this line

$FWDIR/bin/cphaconf set_pnote -d host_monitor -s problem report -----> ifdown (interfacename)

$FWDIR/bin/cphaconf set_pnote -d host_monitor -s ok report -----> ifup (interfacename)

Note that downing an interface like this will cause a failover due to an Interface Active Check pnote being triggered.