Small 25 person branch office - Do I need a seperate ISP router?

[Joe_Kanaszka]

Hi all - 

We have a small 25 person branch office with extremely basic routing needs.  We are currently running on a pair of 5100 Security Gateways configured in a  cluster.   We will be migrating to a pair of 9100s next month.

Wecurrently have a seperate router that is used for our "Active" ISP connection.  Our "Standby" connection terminates directly into the security gateway and the Check Point acts as a router for this ISP.

For a company our size, do we need a seperate ISP router?  When we do our migration to the new 9100s next month, I was considering getting rid oof the router and just plugging the circuit directly into the "External" interface of the 9100.  

[Lesley · Accepted solution]

Does this router do anything special a firewall cannot do or in a limited way? Think of OSPF, BGP

A router is never a firewall and other way around. If nothing special is configured on the router just move the external link directly on the fw. And get rid of the router/ 

You can also ask the ISP if they support this, if you are running a router owned by the ISP. 

[Joe_Kanaszka]

Router does not do anyting special.  Thank you!

[Bob_Zimmerman]

Routers are also useful if you need to terminate exotic link types. For example, Check Point doesn't offer line cards to handle a T3 or SONET/SDH. These connections are increasingly rare outside telcos, but I do still encounter them from time to time.

Just bear in mind that when a cluster member is down, the other member probably won't be able to use anything directly connected to the down member. Thus, an Internet switch is usually very worthwhile.

[the_rock · Accepted solution]

Hey brother,

If customer asked me this question, I would literally say this "No, you dont need separate router, save your money and buy something you do need" : - )

You are welcome 😊

Best,

Andy

[Joe_Kanaszka]

Thank you Andy!

[the_rock]

FYFOC 😊

[the_rock]

@Joe_Kanaszka Maybe not widely known that means "for you, free of charge" : - )

[Chris_Atkinson]

Is the router also providing the L2/switch connectivity needed for the cluster to function or is that separate in your case?

[the_rock]

Btw Joe, here is what AI states the reason to get rid of router, all valid points in my opinion. On a side note, EXCELLENT choice for 9100, those are amazing.

Andy

**************************************

✅ Reasons to Eliminate the Separate ISP Router

1. Simplified Network Architecture:

   • Fewer devices mean easier management and troubleshooting.
   • Reduces potential points of failure.

2. Check Point 9100 Capabilities:

   • These appliances are fully capable of handling basic routing functions, including static routes, policy-based routing, and ISP redundancy.
   • They support multiple WAN interfaces and can manage failover between ISPs.

3. Cost Savings:

   • Removing the router saves on hardware, power, and potential support contracts.

4. ISP Redundancy Features:

   • Check Point’s ISP Redundancy feature allows you to configure both Active and Standby ISP links directly on the gateway.