Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
MarcuzShinz
Contributor

Which Check Point HA model will support Alias ​​Interface?

Hi Guy!

I have some questions and hope everyone can help. As far as I know Check Point Cluster will not support Alias ​​Interface. So is there any other HA model that supports this type of interface?

2024-08-13_164718.png

 

0 Kudos
9 Replies
emmap
Employee
Employee

I don't think any of them well, what's the use case?

0 Kudos
MarcuzShinz
Contributor

We have multiple public IPs configured on the same interface, as you can understand similar to Fortigate it is the same secondary IP. On the Check Point it will be the Alias ​​interface, currently I am using Gateway with Standalone mode, so I can configure Alias ​​Interface, however, I want the system to be redundant. We need a Check Point HA model that supports Alias ​​Interface.

I'm thinking about VRRP but don't know how it would work, and also if it supports alias interface?

0 Kudos
_Val_
Admin
Admin

You cannot run a Full HA cluster in VRRP, it has to be ClusterXL, AFAIK. 

0 Kudos
Alex-
Leader Leader
Leader

If I understand correctly, you want more than one public IP to answer on your public interface.

In this case, you could use Proxy ARP to have the public interface respond to these IP's.

PhoneBoy
Admin
Admin

What is the precise use case for these alias IP addresses?
If it's for a device behind the gateway, you can create automatic NAT rules to make those IPs available.
If you are doing manual NAT rules, you'll need to create proxy ARPs for the relevant IP.

If this is not your use case, please provide details.

0 Kudos
MarcuzShinz
Contributor

Dear PhoneBoy,

Let me explain the issue in detail below:

1. The first, we have configured interface as image below:

2. I have some internal servers inside and configured with static NAT pointing out at these IPs.

 

The Arp Proxy you suggested only supports "The procedure below is for Source Manual NAT only (Destination Manual NAT is currently not supported)". I need both.

 

0 Kudos
MarcuzShinz
Contributor

Sory

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Routing, NAT pools or Proxy-ARP are the common tools available to assist here.

Regarding Alias IP support please refer: https://support.checkpoint.com/results/sk/sk89980  

CCSM R77/R80/ELITE
PhoneBoy
Admin
Admin

None of the items under "Range IP Alias" should require Alias IPs on the gateway.
A regular Proxy Arp should suffice here and should work where the destination IP requires NAT.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events