I'm new to Checkpoint gateway and see if someone could help to answer the below questions. Much appreciated.
Site A has a pair of gateways that formed a simple active-standby Cluster. Each gateway member has its own ISP internet connection. Only 1 internal network interface was formed HA. So the Cluster topology will look like this:
LAN1: 192.168.1.1 (Cluster VIP)
LAN2: Sync port
WAN1: 10.10.10.1 (ISP1, External, monitored private, on cluster member 1)
WAN2: 172.10.10.1 (ISP2, External, monitored private, on cluster member 2)
A star VPN community was created with standard settings to a peer firewall gateway, tunnels are permanent.
In peer gateway, an Externally Managed Checkpoint Gateway object was created for Site A and topology was defined properly. Since Site A cluster has two internet connections, in IPSec VPN > Link Selection, I selected use probing link redudancy mode in HA mode. The two IP addresses 10.10.10.1 and 172.10.10.1 are keep ongoing probing. And in Link Selection > Source IP Address Settings, it use default Automatic.
After the setup, VPN tunnels are up and all connections looks fine. But there is always 3-4 PING lost in around every 1,000 PINGS.
Q1: I found there are packet named tunnel_test from peer gateway send to Site A cluster, I believe these are packets for probing. But I didn't see Site A cluster receive any these traffic. Instead, Site A cluster drops a number of UDP 17 packets. May I know what are these UDP 17 packets for?
Q2: In Link Selection > Source IP Address Settings, should I use default Automatic or Manual > IP addresses of chosen interface when the peer cluster has two external IPs but each on different cluster member?
Q3: An Externally Managed Checkpoint Gateway object refers to a gateway or a Host which has Check Point software (Gaia) installed on it. Does this software also include Gaia Embedded? If the peer gateway is SMB, should I still use Externally Managed Checkpoint Gateway object to define it?
