ISP Redundancy with R80.20

[lullejd]

Hi all,

Is anyone experiencing any problems with ISP redundancy when upgrading from R77.30 to R80.20?

Basically what is happening is that the client has a firewall with ISP Redundancy Active/Backup. The Active connection is the PPPoE while the Backup connection is the fiber link with a /28 subnet. Now, with R77.30, with this configuration, traffic goes out through the PPPoE connection. Services which are NATted on the Fiber (backup link) still work. If you do an FWmonitor, you can see that a request to a web server on the backup link, hits the correct NAT rule, reaches the server, the server replies back, NATs and goes out of the backup link interface. So far so good.

From R80.20, if you try the same procedure, you can see that the request comes from the backup link, BUT reply goes out of the primary link, causing asymmetric routing.

To be honest this used to happen on R77.30 but if you disable secureXL issue would be sorted.

This is a huge issue since R77.30 is reaching end of life and all clients should be migrated to r80.XX or later. 

Anyone experiencing anything similar on his setup?

Thanks

Darryl.

[Wolfgang]

Darryl,

I'm wondering that this was working in R77.30.

With ISP redundancy in active/ backup configuration it is normal behaviour that only the active ISP is used for all outgoing traffic including the return packets coming from the backup ISP.

If you use ISP redundancy in LoadSharing mode there is a connection stickyness, meaning connection coming in from ISP-A are answered via ISP-A and the same with ISP-B.

Wolfgang

[lullejd]

Hi Wolfgang,

Yes it worked on R77.30. 

Infact we opened a case with TAC and provided us with a hotfix for R80.20 and now traffic is being sent through the correct interface. So Checkpoint know about it however doesn't seem to be documented anywhere.

Thanks

Darryl.

[G_W_Albrecht]

This issue is documented here: 

sk113236: TCP traffic fails to return from static NAT host when using ISPRedundancyand SecureXL

[lullejd]

Thanks for the link.

Even with SecureXL off it happens.

On r77.30 it worked fine for sure as I had several clients with similar setups and worked before upgrade.

[G_W_Albrecht]

Looks rather like IPS Redundancy LS to me, similar to: sk56384: How To Create a Redundant, Service-based MPLS/Encrypted Link VPN