PBR limitations

[GG27]

Hi Mates,

reading the sk100500 I was very surprised when it described

The following features/blades are not supported with PBR:

• IPv6
• Locally-generated traffic
• Security Servers
• Data Loss Prevention (DLP) blade
• Anti-Spam blade
• Mail Transfer Agent (MTA) (relevant for Threat Emulation/Threat Extraction/Data Loss Prevention/Anti-Spam blades)
• ISP Redundancy
• The following applications (which use Check Point Active Streaming [CPAS]):
  
  • VoIP (H323, SIP, Skinny, etc.)
  • HTTPS Inspection
  • HTTP Header Spoofing
  • HTTP Proxy
  • IMAP in IPS

Despite my idea where, routing feature on the gateway musn't influence the security features, at the moment I need to have a PBR on a gateway where MTA is active for the TEX blade.

In the enviroment where I'd like to implement PBR and I have MTA enabled on a R80.10 gateway, the PBR doesn't work.

Does someone face the same scenario ?

Does someone know a workaround/solution?

[PhoneBoy]

Locally generated traffic accounts for most of the limitations, including MTA.

It would be useful to hear about your specific use case in a little more detail.

[GG27]

the idea shoud be implement a PBR to move internet browsing from a proxy server inside the network throught out a new provider.

I implemented the PBR as I made in the past for other costumers, but it the first time the PBR doesn't work.

I mean running "IP RULE" command in expert mode on the gateway, I see the matches at my PBR.

Dumping the traffic, instead, the packets are forwarded by the route in the main route tables

[PhoneBoy]

Routing configuration changes needs to be done via clish and not using the ip command via expert mode.

Are you using the security gateway as the explicit proxy in this case?

[GG27]

the "ip rule" command is described in the SK for debugging PBR on Secure Gateway.

obviously I implemented PBR from clish.

In reply at your question "Are you using the security gateway as the explicit proxy in this case?", the response is NO, I have an external proxy gateway.

[PhoneBoy]

So how is the traffic flowing from your clients to the Internet?

Since proxies are involved, need to understand where the TCP connections are terminating.

And are you using the Transparent proxy option?

[GG27]

the browser on client is configured to use explicit proxy and the communication starts from client and terminate at the proxy end.

The proxy, then, initiates the connection to the web site

in other words, running tcpdump on gateway I see as source IP, the IP of proxy server

[PhoneBoy]

So do the packets from your internal proxy server terminate on another proxy server or just go to the Internet sites directly?

Also, my question about proxy mode, which you didn't answer.

The setting is here:

[GG27]

Hi Dameon

The internal proxy goes out to the internet directly. No more proxy are in the middle between internal proxy and internet.

In reply CKP proxy configuration, the gateways are not configured as a proxy and the box on the property is not tricked.

[PhoneBoy]

I recommend opening a TAC case to troubleshoot this as, to the best of my knowledge, this should work. 

[D_W]

Hi,

I also have a questions to the Limitations stated in SK100500.

We use URLFilter and IPS so the limitation is that those two features are not working for traffic that is handled by the PBR OR are  those features without function for every traffic?

KR

David

[G_W_Albrecht]

According to sk100500, IPS  and URLF are not working with PBR.

[D_W]

Yes this SK100500 is telling us that but my question is if the whole IPS and URLF is not working/supported or only not supported/working for the PBR traffic?!

[FedericoMeiners]

I think that the limitations are pointing that you cannot make routing decisions based on those blades.

If not I would be really confused, I have many customers with PBRs and IPS and both blades are working like a charm.

Would be nice that someone from Check Point clarifies it, it's true that the sk is not clear enough.

[Gro_Tea]

Hi,

the post is long ago, but at the moment I'm facing some problems regarding pbr. I just wanted to ask you if you got any response from officials regarding the mentioned incompatibility with PBR and some core features?

Thanks in advance,

Frank

[Peter_Lyndley]

It would be great if someone from Check Point could clarify this.

We have two open TAC cases for different customers and we cannot move forward as TAC are saying the blades you have enabled will not work with PBR.

It would be really helpful if someone could answer why, rather than just pointing us to this ambiguous SK

thanks

Peter

[Enrique]

Hello,

Does anyone know if it is possible to configure Mobile Access with PBR?

I have two ISP in two different firewall's interfaces and we would like to publish only the Mobile Access portal with the ISP which is NOT the default gateway. 

I've performed some traffic captures and fw monitor, and I clearly see that traffic is reaching through ISP2 but the returning traffic is being routed through ISP2.

Thank you to everyone in advance, I really really like this community.

[Nicolas_Vanhoek]

see sk76281  -
did you select Reply from the same interface ?

When Responding to a Remotely Initiated Tunnel

When responding to a remotely initiated tunnel, there are two options for selecting the interface and next hop that are used. These settings are only relevant for IKE and RDP sessions.

These settings are configured in Link Selection > Outgoing Route Selection > Setup > Link Selection - Responding Traffic window.

• Use outgoing traffic configuration - Select this option to choose an interface using the same method selected in the Outgoing Route Selection section of the Link Selection page.
• Reply from the same interface - This option sends the returning traffic through the same interface and next hop it that it arrived in.

Note - When Route Based Probing is enabled, Reply from the same interface is the selected method and cannot be changed.

Kind regards

Niky