Policy Based routing with reduntant ISP links

[JaySon_2021]

We have an HA firewall pair, and 2 ISP links. We want to utilize Policy based routing AND have traffic fail-over completely to either ISP1 or ISP2 if the circuit goes down.

Example:

- Net_10.1.1.0/24 goes through the Checkpoints and out ISP1

- Net_192.168.1.0/24 goes through the Checkpoints and out ISP2

If ISP1 goes down, then both Net_10.1.1.0/24 and Net_192.168.1.0/24 will be sent out ISP2, and vice versa.

Is this possible with PBR?

Thanks

[PhoneBoy · Accepted solution]

That should be possible with PBR, yes.

[the_rock · Accepted solution]

Hey Jeff,

Check out below post I made before holidays.

https://community.checkpoint.com/t5/Security-Gateways/ISP-redundancy-PBR-sd-wan-question/m-p/265222

[CheckPointerXL]

did i study how to apply nat? in case of zone+r82 pay attention and take a look here https://support.checkpoint.com/results/sk/sk184176

[the_rock]

Hey Jeff,

Hope link I shared helped?

Happy weekend!

[JaySon_2021]

Yep. Helped clarify things. Appreciate it.

[the_rock]

For you, no charge...EXCEPT iphone charge. Thats my CORNY joke Im sure everyone is sick of lol

Anyway, yea, you can definitely open TAC case, though Im positive they will tell you the same thing.

For reference:

https://support.checkpoint.com/results/sk/sk167135

[the_rock]

Be free to message me directly any time, I have a very good lab set up, so most things can be tested.

[WiliRGasparetto]

Yes, PBR should allow that

[the_rock]

The catch is...would allow that, but PBR ONLY...NO ISPR involved : - )

Together, wont work.

[JaySon_2021]

Thanks all for the responses. As I am getting mixed responses perhaps a TAC case is best.

Regards,

[Chris_Atkinson]

Their is conceptual & feature naming...

ISP redundancy doesn't necessarily mean you are using the Check Point feature by the same name where PBR is a limitation.