PBR source port or fwrule

[Arthur_DENIS1]

Hi,

I try to setup a PBR rule - but i'm currently stuck...

Is it possible to use PBR rule matching source port instead of destination port ?

Or, second question - how can we use the match on fwrule ?

0> set pbr rule priority 300 match fwrule
Configures the 'firewall rule' match condition for a
Policy Based Routing (PBR) rule.

Value: Specify which firewall rule to match by
entering the rule number or rule name, as
it appears in SmartConsole

The firewall rule must be configured through SmartConsole
first before you can use it here. When creating the rule
in SmartConsole, it must begin with the prefix 'PBR_'
followed by the rule name.

Example: PBR_SSH, PBR_Telnet

0> set pbr rule priority 300 match fwrule PBR_test
RTGRTG0001 FW rule ID does not exist.
set pbr rule priority 300 match fwrule PBR_test
--------------------------------^^^^^^^^^^^^^^^


Thanks !

[Wolfgang]

@Arthur_DENIS1  How to use firewall rules for application based PBR Policy-Based Routing and Application-Based Routing in Gaia 

Use of firewall rules for PBR will be used for ABR (Application Based Routing). PBR for source port is not supported. 
Please explain what do you want, maybe ther‘s another solution.

[Arthur_DENIS1]

Hi @Wolfgang 

Thanks for the answer.
What if I use a firewall rule containing service restricted to a source port ? Can work or not ?

Source port should be possible, based on sk100500 - "The following features are not supported by PBR by default, and are available only as a Request for Enhancement (RFE) via Check Point local office: PBR with Source Port routing"
So I assume that it as already implemented for somes customers 🙂

Please find attached a draft of the target design.
The need: be able to initiate opnvpn from IP public 1 and/or 2 in the same time. I do not find other way to do that without PBR...
Any ideas are welcome !

[PhoneBoy]

The functionality of PBR based on Source Port requires a specific software release, most likely.
Your local Check Point office should be able to get the details of this.