- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: Which Check Point HA model will support Alias ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Which Check Point HA model will support Alias Interface?
Hi Guy!
I have some questions and hope everyone can help. As far as I know Check Point Cluster will not support Alias Interface. So is there any other HA model that supports this type of interface?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't think any of them well, what's the use case?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have multiple public IPs configured on the same interface, as you can understand similar to Fortigate it is the same secondary IP. On the Check Point it will be the Alias interface, currently I am using Gateway with Standalone mode, so I can configure Alias Interface, however, I want the system to be redundant. We need a Check Point HA model that supports Alias Interface.
I'm thinking about VRRP but don't know how it would work, and also if it supports alias interface?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You cannot run a Full HA cluster in VRRP, it has to be ClusterXL, AFAIK.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I understand correctly, you want more than one public IP to answer on your public interface.
In this case, you could use Proxy ARP to have the public interface respond to these IP's.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is the precise use case for these alias IP addresses?
If it's for a device behind the gateway, you can create automatic NAT rules to make those IPs available.
If you are doing manual NAT rules, you'll need to create proxy ARPs for the relevant IP.
If this is not your use case, please provide details.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dear PhoneBoy,
Let me explain the issue in detail below:
1. The first, we have configured interface as image below:
2. I have some internal servers inside and configured with static NAT pointing out at these IPs.
The Arp Proxy you suggested only supports "The procedure below is for Source Manual NAT only (Destination Manual NAT is currently not supported)". I need both.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sory
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Routing, NAT pools or Proxy-ARP are the common tools available to assist here.
Regarding Alias IP support please refer: https://support.checkpoint.com/results/sk/sk89980
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
None of the items under "Range IP Alias" should require Alias IPs on the gateway.
A regular Proxy Arp should suffice here and should work where the destination IP requires NAT.
![](/skins/images/74119E49EB1AA30407316FFB9151D237/responsive_peak/images/icon_anonymous_message.png)