A setup question

[ggts2008]

Hi All,

I have UTM-1 450.

I have 3 internet lines coming from different ISPs. The current setup scenario is one Internet line is dedicated to an Exchange server. Other two internet lines are used for browsing for the LAN users.

I am implementing UTM-1 450 where all the three lines land in Check Point.

I have setup ISP redundancy (load sharing) with the three lines. My problem is how do I prevent the LAN users from using the line dedicated to Exchange server. If the two lines go down, the LAN users will start using the line dedicated to the Exchange (please correct me if I am wrong).

How should I write the NAT/Security rules so that the line to the Exchange is not used by LAN users at any point.

My second question is - Is there a way where I can split the traffic as 60-40% in the two leased lines used by the LAN users for browsing (I think sonicwall has this feature)?

Can somebody help please?

Thanks in advance.

[melipla]

Originally Posted by ggts2008

I have setup ISP redundancy (load sharing) with the three lines. My problem is how do I prevent the LAN users from using the line dedicated to Exchange server.

Based on your configuration, if 2 of the 3 ISP Links went down, everyone would automatically start using the last available ISP link. There's two things you could do, set up QoS such that Exchange traffic takes priority or manually prevent it by pushing a rule which would drop everything except for Exchange traffic...

Originally Posted by ggts2008

My second question is - Is there a way where I can split the traffic as 60-40% in the two leased lines used by the LAN users for browsing (I think sonicwall has this feature)?

Not in a Load Sharing ISP Redundancy model:

Load Sharing mode connects to both ISPs, while distributing the load of outgoing connections between the ISPs. New connections are randomly assigned to a link. If a link fails, all new outgoing connections are directed to the active link.

If you had two UTM-1's you could set up a Load Sharing Cluster which you'd then be able to designate which member gets more traffic.