Hi Team,
This is my second post on the Check Point community, and I must say I find this platform extremely helpful in resolving many of my concerns.
I’m seeking your expert opinion on a requirement we’re working on: ensuring that return traffic is routed through the same interface it originally arrived on.
As illustrated in the attachment, we need to publish a single web application using two public IP addresses provided by two different ISPs. For example, let’s say we’re publishing the website example.com to the internet. DNS load balancing (round-robin) is being used to distribute requests between the two IP addresses.
Here’s the current scenario:
Traffic coming to x.x.x.x (ISP1) is NATed to z.z.z.z, and since the firewall’s default route points to ISP1, return traffic is successfully routed back via ISP1.
However, traffic arriving at y.y.y.y (ISP2) is also NATed to z.z.z.z, but the return traffic is still sent out via ISP1 due to the default route. As a result, the application doesn’t work properly when accessed via ISP2.
Could you please confirm whether this type of return routing (i.e., symmetric routing based on incoming interface) can be achieved using Check Point? If so, i would appreciate your guidance on how to implement it. If not, are there any recommended workarounds?
