- Products
- Learn
- Local User Groups
- Partners
- More
Check Point Jump-Start Online Training
Now Available on CheckMates for Beginners!
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
ZTNA Buyer’s Guide
Zero Trust essentials for your most valuable assets
The SMB Cyber Master
Boost your knowledge on Quantum Spark SMB gateways!
Check Point's Cyber Park is Now Open
Let the Games Begin!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
Hello All,
Is it possible to cascade link failure form one interface to another. If the Internet facing link fails, then we want to take down a specific interface on the Check Point gateway. When the Internet facing link comes up, then the specific interface is reactivated. There are monitored IPs, but there seems no way to link the status of an interface to a monitored IP.
We are looking at if Check Point can replace Fortinet for particular customer and this is one feature the Fortinet has, that I cannot find a similar feature for on the Checkpoint.
The Fortinet feature is the following, if Port3 goes down then Port 4 is also shutdown.
It woudl be possible with a script that is running periodically on the gateway, but a customized script is something that the customer would feel comfortable supporting.
Many thanks,
Michael
Is there dynamic routing used in this environment?
If the interfaces are bridged you have the option of Link State Propagation:
Hello Chris,
The FW is running in routed mode.
Regards,
Michael
If you are using ClusterXL you can adapt the clusterXL_monitor_ips script to do what you want. sk92904: How to configure $FWDIR/bin/clusterXL_monitor_process script to run automatically on Gaia /...
This script is used to ping an IP address and then issue a pnote when the IP no longer responds, thus causing a failover. Replace the following lines in the script:
$FWDIR/bin/cphaconf set_pnote -d host_monitor -t 0 -s ok register -----> Comment out this line
$FWDIR/bin/cphaconf set_pnote -d host_monitor -s problem report -----> ifdown (interfacename)
$FWDIR/bin/cphaconf set_pnote -d host_monitor -s ok report -----> ifup (interfacename)
Note that downing an interface like this will cause a failover due to an Interface Active Check pnote being triggered.
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY