Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
vsurresh
Contributor

Management Plane Separation - mdps_tun connected route

Hi all. 

I recently made the change to enable management plane separation following sk138672. After the change, I noticed something I don't understand. Attached you will find a diagram that represents the network. 

If I connect (ssh, https) from the PC (green) the traffic goes to the check point management interface directly and no issues. The traffic goes directly into the management interface and doesn't have to traverse the check point data plane.

If I, however, connect from the laptop (shown as black on top of the diagram) from a different network, I'm getting a connection refused from the firewall. My understanding is that the data plane and management plane are totally isolated so, the traffic should follow the following path. 

Laptop > check point (eth1) > Router > check point management interface. However, it doesn't work at the moment. I already have a firewall policy to allow the connections. (Check point has a static route for 172.16.10.0/24 pointing to the Router)

If I check the data plane routing table, it has an entry for 172.16.10.10/32 shown as mdps_tun. Does that mean the traffic is not forwarded to the router? 

C 172.16.10.10/32 is directly connected, mdps_tun

Thanks in advance. Diagrams-1 5.jpg

 

0 Kudos
7 Replies
_Val_
Admin
Admin

This is the expected behaviour if you enabled the management plane. Any your question is?

0 Kudos
vsurresh
Contributor

Thanks for the response. When you say expected behaviour, does that mean the firewall 'won't' allow traffic crossing from the data plane to the management plane even via a different path? (not directly crossing between the planes)

My question is, why the check point just doesn't send the traffic to the next hop which is the router? 

0 Kudos
_Val_
Admin
Admin

No, it does not mean that. You need to run some traces to see if the traffic from production plane to MGMT interface is dropped, and go from there. It is not enough info here to say why it happens. 

0 Kudos
vsurresh
Contributor

Thanks, I will get in touch with the support to investigate further. 

0 Kudos
_Val_
Admin
Admin

That would be a good idea

0 Kudos
laurent_ragon
Participant

HI vsurresh, have you opened a case? I have also different problem with the mplane when it need to reach a network via the dplane.

the flow is blocked by the ANti Spoofing because it detect this is a local ip address. I have disabled the local antispoofing but the log is not anymore presented but the mplane don't get any response.

and I have another problematic to manage the NAT, because the Nat configuration is global and not by plane.  

I think the better way to have a plan separation is to use the VSX.

 

0 Kudos
Malik1
Contributor

Hi, 

Were u able to resolve this? 

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events