Has ISP redundancy started supporting more than 2 ISP links?

[blason]

Hey guys,

I just heard that CheckPoint has started supporting more than 2 links is ISP redundancy, is it true? Plus can anyone please confirm if PBR can work along with ISP redundancy?

AFAIK and mentioned in admin guide PBR wont work if ISP redundancy is enabled and we will have to switch that feature off.

[ShadowPeak.com]

Hey guys,

I just heard that CheckPoint has started supporting more than 2 links is ISP redundancy, is it true? Plus can anyone please confirm if PBR can work along with ISP redundancy?

AFAIK and mentioned in admin guide PBR wont work if ISP redundancy is enabled and we will have to switch that feature off.

Hmm that is news to me. There is no way to add more than 2 ISPs that I can see, at least through the SmartDashboard.

ISP Redundancy can make routing changes in the Firewall Path on the outbound side of the kernel (o->O) based on what defined ISPs are up, and that is well after regular destination-based IP routing or PBR has occurred in the IP driver. Unless PBR is somehow integrated into the INSPECT driver as opposed to being handled exclusively in the IP driver I don't see how that could work.

[blason]

Well I came to know from CheckPoint that there is a customer specific Hot fix available by which 10 ISPs can be configured in ISP redundancy. even this is surprising to me.

[blason]

Again pertaining to same question, since now I have VPN tunnel configured between sites and as PBR does not support it. I need to exclude couple of IPs from VPN tunnel can it be possible? Like this


10.1.1.0/24-----10.1.1.1-20.20.20.1=========30.30.30.1----192.168/16

10.1.1.0/24 -> Encryption Domain at other site
192.168./16 is a encryption domain at my end

and I want 192.168.1.50 to be routed differently and dont want to send through tunnel hence wondering if that can be possible?

[Cory Webb]

There is a special macro called NON_VPN_TRAFFIC_RULES that will prevent traffic from being sent through the VPN. You can edit the user.def file or the crypt.def file using Check Point INSPECT language to define this, just search the support center and you'll find a few SKs on it

[blason]

Yep I found that option and need to implement that. Will keep you guys posted on it.