Checkpoint ClusterXL and Cisco ASA Failover cluster VPN with BGP

[OlegPowerC]

Hello!

I configured tunnel from my ASA to Checkpoint Cluster XL.

All work but I not shure about properly work BGP.

I configured some router id on each gateways on the cluster (VIP of the internal interfaces)

Some peer - My ASAs tunnel interface ip

And on active gateway i see:

TEST-CHPSG01> show cluster roles

ID Role

1 (local) Master
2 Non-Master

TEST-CHPSG01> show bgp peers

Flags: R - Peer restarted, W - Waiting for End-Of-RIB from Peer

PeerID AS Routes ActRts State InUpds OutUpds Uptime
169.254.129.4 65312 1 1 Established 2 0 11:19:06

On second:

Oleg Volkov, [10.10.2024 12:57]
CUDD-CHPSG01> show bgp peers

Flags: R - Peer restarted, W - Waiting for End-Of-RIB from Peer

PeerID AS Routes ActRts State InUpds OutUpds Uptime
169.254.129.4 65312 1 1 Established 2 0 11:19:06

Oleg Volkov, [10.10.2024 12:57]
TEST-CHPSG02> show cluster roles

ID Role

1 Master
2 (local) Non-Master

TEST-CHPSG02> show bgp peers

Flags: R - Peer restarted, W - Waiting for End-Of-RIB from Peer

PeerID AS Routes ActRts State InUpds OutUpds Uptime
169.254.129.4 65312 0 0 Idle 0 0 00:00:00

After I reload active gateway and check BGP session on standby:

TEST-CHPSG02> show bgp peers

Flags: R - Peer restarted, W - Waiting for End-Of-RIB from Peer

PeerID AS Routes ActRts State InUpds OutUpds Uptime
169.254.129.4 65312 0 0 Idle 0 0 00:00:00

Multiple times - Idle

TEST-CHPSG02> show bgp peers

Flags: R - Peer restarted, W - Waiting for End-Of-RIB from Peer

PeerID AS Routes ActRts State InUpds OutUpds Uptime
169.254.129.4 65312 0 0 Active 0 0 00:00:00

Multiple times Active

TEST-CHPSG02> show bgp peers

Flags: R - Peer restarted, W - Waiting for End-Of-RIB from Peer

PeerID AS Routes ActRts State InUpds OutUpds Uptime
169.254.129.4 65312 1 1 Established 2 1 00:00:00

And now established.

I have 3-5 sec (sometimes more) downtime when standby gateway become active

May be I configured it improperly?

Second question is the best way to configure dynamic routing beatwen ClusterXL and cisco/Huawei routers. OSPF/IS-IS/BGP?

What I must do? configure peering to each gateways or to VIP address?

If to each gateways how Cisco will know about which route is prefer (which gateway is active)?

Thank You!

[PhoneBoy · Accepted solution]

You should configure the routers to use the VIP only.
It may take a couple seconds for the ClusterXL failover to occur.

[OlegPowerC]

Thank You!

Can You explain me how I can to switch active gateway without reooting?

And second question, which protocol do you recommend as IGP with checkpoint for minimal downtime?

Thank you!

[PhoneBoy]

I believe you can execute the command clusterXL_admin down to do this (clusterXL_admin up to reverse it).

The choice of an IGP depends on a number of factors.
From what I see on the community, OSPF is probably the most commonly used.

[JozkoMrkvicka]

Make sure BGP port (tcp/179) is allowed in both directions. It should be allowed for VIP IPs.