Which Check Point HA model will support Alias ​​Interface?

[TronNQ]

Hi Guy!

I have some questions and hope everyone can help. As far as I know Check Point Cluster will not support Alias ​​Interface. So is there any other HA model that supports this type of interface?

[emmap]

I don't think any of them well, what's the use case?

[TronNQ]

We have multiple public IPs configured on the same interface, as you can understand similar to Fortigate it is the same secondary IP. On the Check Point it will be the Alias ​​interface, currently I am using Gateway with Standalone mode, so I can configure Alias ​​Interface, however, I want the system to be redundant. We need a Check Point HA model that supports Alias ​​Interface.

I'm thinking about VRRP but don't know how it would work, and also if it supports alias interface?

[_Val_]

You cannot run a Full HA cluster in VRRP, it has to be ClusterXL, AFAIK. 

[Alex-]

If I understand correctly, you want more than one public IP to answer on your public interface.

In this case, you could use Proxy ARP to have the public interface respond to these IP's.

[PhoneBoy]

What is the precise use case for these alias IP addresses?
If it's for a device behind the gateway, you can create automatic NAT rules to make those IPs available.
If you are doing manual NAT rules, you'll need to create proxy ARPs for the relevant IP.

If this is not your use case, please provide details.

[TronNQ]

Dear PhoneBoy,

Let me explain the issue in detail below:

1. The first, we have configured interface as image below:

2. I have some internal servers inside and configured with static NAT pointing out at these IPs.

The Arp Proxy you suggested only supports "The procedure below is for Source Manual NAT only (Destination Manual NAT is currently not supported)". I need both.

[TronNQ]

Sory

[Chris_Atkinson]

Routing, NAT pools or Proxy-ARP are the common tools available to assist here.

Regarding Alias IP support please refer: https://support.checkpoint.com/results/sk/sk89980  

[PhoneBoy]

None of the items under "Range IP Alias" should require Alias IPs on the gateway.
A regular Proxy Arp should suffice here and should work where the destination IP requires NAT.