No of PBR limitations

[Balakrishna_Med]

Hi,

We are facing the issue with No.of PBRs,

Scenario... We have Juniper Switch with Virtual routers... we have installed Checkpoint IPS between Juniper Firewall and Juniper Switch... and we are routing the traffic through Checkpoint using PBR.

Support person not recommending more PBR(No.of PBR are 15)

Is it really limitation from Checkpoint 80.10? any suggestions please...

Thanks

Bala

[Danny]

There is no limit of PBR rules. Check Point officially declares in sk100500 that "You can define many Policy Rules."

Check Point does not note how many, but many for me means that only 15 PBR rules should be no issue at all.

[Licensing_User]

Hello Danny,

We have a similar situation with one of our clients, the only issue is "many" in our case means we need 2500 PBR.

Check Point advised that "many" means 1024 only, so we have to go for a Linux PBR solution.

These routes will only stay for 3-6 months and will go to a single DG once the local network migration is complete.

My question is; will all limitations still apply if we implement PBR via Linux commands and 2500 individual rules?

do you foresee any challenges in doing this or any work around that can be helpful, Please?

Thanks

[Licensing_User]

Hello All,

Can anyone please reply to the above question if they know about this, please?

Thanks

[PhoneBoy]

If you're trying to modify PBR with Linux commands (via expert mode) on the gateway, that is most definitely not supported.
If you're implementing the PBR on an external device, that's up to the external device.

What version/JHF are we talking about here?

[Licensing_User]

Thanks for your reply.

we had a TAC case opened with ref:6-0003441780, and it was advised that the Linux commands could be used.

It was our SD who was involved with CP TAC, but I will confirm the current version asap.

Thanks

[PhoneBoy]

It depends on where the PBR limit is coming from (the Linux kernel or the Gaia configuration DB).
That might be a question for TAC, though I am also asking out of band.

[Licensing_User]

Ok, Thanks for that. I did open a new TAC case, but no response yet. please let me know if you find out anything.

Thanks

[PhoneBoy]

TAC will ultimately tell you the same thing that @Sundeep_Mudgal answered as his team in R&D is responsible for PBR functionality in Gaia.
Recommend raising this requirement with your local Check Point office.

[Licensing_User]

Its R80.40 T180

[Sundeep_Mudgal · Accepted solution]

Gaia ultimately pushes these rules to kernel so same limitations should apply either way. Please open a RFE request if you need 2500 PBR rules to be supported in Gaia.

[Licensing_User]

Thanks for the info @Sundeep_Mudgal 

[Licensing_User]

@Sundeep_Mudgal , it seems the RFE is a general feature request and might not be implemented. can a custom hotfix be provided if we contact local CP or a request via TAC?

[PhoneBoy]

While it wouldn't hurt to file an RFE, this request should be handled through your local Check Point office.