Configuring Active-Standby BGP for Site-to-Site Through SASE (Quantum and Maestro)

When to Use This

Use this procedure for site-to-site traffic that transits Check Point SASE over two redundant route-based Virtual Tunnel Interface (VTI) tunnels when the site cannot guarantee that it returns each response on the same tunnel on which it received the request.

In this case, both directions must be pinned to a single tunnel in an active-standby configuration. Otherwise, responses can reach a different SASE Gateway from the Gateway that handled the request and be dropped.

Agent-to-site traffic in either direction is not affected and can use either mode.

This procedure applies to Quantum single gateways, Quantum clusters, and Maestro. VSX runs routing in a virtual-system context and uses different tunnel-creation commands. The same principles apply, but adapt the commands to the VSX virtual-system context.

Before You Start

This procedure continues from the redundant-tunnel Administration Guide procedure after the VPN tunnel interfaces are created. This procedure covers only the active-standby BGP configuration.

  • If the VTIs are already created through the Gaia Portal, as described on the Administration Guide page, continue to BGP Configuration in Gaia Clish.

  • If the VTIs are not created, create the two numbered VTIs first. Return to the tunnel-interface step on your platform's Administration Guide page, or create the VTIs in Gaia Clish.

Run:

Copy 
add vpn tunnel 1 type numbered local <PRIMARY_VTI_LOCAL_IP>   remote <PRIMARY_PEER_VTI_IP>   peer <PRIMARY_INTEROP_NAME>
add vpn tunnel 2 type numbered local <SECONDARY_VTI_LOCAL_IP> remote <SECONDARY_PEER_VTI_IP> peer <SECONDARY_INTEROP_NAME> 

On a cluster, create the tunnels on both members. Each member uses its own local VTI IP address. In SmartConsole, set the VIP on the tunnel interfaces with Get Interfaces Without Topology. Then continue with the BGP configuration.

Choose the Primary Region

Decide which of the two SASE regions is the primary active path. The other region becomes the secondary standby path.

There is no product-preferred primary region. Choose the primary region based on your routing policy.

In the commands:

  • <PRIMARY_PEER_VTI_IP> is the VTI remote address of the primary region's SASE Gateway.

  • <SECONDARY_PEER_VTI_IP> is the VTI remote address of the secondary region's SASE Gateway.

BGP Configuration in Gaia Clish

Enter the commands in Gaia Clish, and then run save config. On a cluster, enter the commands identically on both members.

Placeholders:

  • <LOCAL_AS>: This gateway's AS

  • <ROUTER_ID>: Router ID

  • <SASE_AS>: SASE AS. The default value is 64512

  • <PRIMARY_PEER_VTI_IP> and <SECONDARY_PEER_VTI_IP>: VTI remote addresses of the primary and secondary regions

  • <LAN_PREFIX>: Internal subnet to advertise

  • <N>: Prepend count

Step 1 - Configure the AS Number and Router ID

Run:

Copy 
set as <LOCAL_AS>
set router-id <ROUTER_ID>

Step 2 - Configure Inbound Route Maps

Prefer the primary region for return traffic. Give routes learned from the primary peer a lower preference value. In Gaia, a lower preference value wins. Set the primary preference value lower than the secondary preference value.

Run:

Copy 
set routemap sase_prim_in id 10 on
set routemap sase_prim_in id 10 allow
set routemap sase_prim_in id 10 match neighbor <PRIMARY_PEER_VTI_IP> on
set routemap sase_prim_in id 10 action preference 1
set routemap sase_sec_in id 10 on
set routemap sase_sec_in id 10 allow
set routemap sase_sec_in id 10 match neighbor <SECONDARY_PEER_VTI_IP> on
set routemap sase_sec_in id 10 action preference 50

Step 3 - Configure Outbound Route Maps

Advertise the LAN and prepend the AS path on the secondary path. Set the matched protocol according to how the LAN prefix exists on the gateway. Use static for a static route or direct for a connected interface.

Run:

Copy 
set routemap bgpout id 500 on
set routemap bgpout id 500 allow
set routemap bgpout id 500 match as <SASE_AS> on
set routemap bgpout id 500 match network <LAN_PREFIX> all
set routemap bgpout id 500 match protocol <direct|static>
set routemap bgpout_sec id 500 on
set routemap bgpout_sec id 500 allow
set routemap bgpout_sec id 500 match as <SASE_AS> on
set routemap bgpout_sec id 500 match network <LAN_PREFIX> all
set routemap bgpout_sec id 500 match protocol <direct|static>
set routemap bgpout_sec id 500 action aspath-prepend-count <N>

Step 4 - Configure BGP Peering and Bindings

Run:

Copy 
set bgp external remote-as <SASE_AS> on
set bgp external remote-as <SASE_AS> import-routemap sase_prim_in preference 1 on
set bgp external remote-as <SASE_AS> import-routemap sase_sec_in preference 2 onset bgp external remote-as <SASE_AS> peer <PRIMARY_PEER_VTI_IP> on
set bgp external remote-as <SASE_AS> peer <PRIMARY_PEER_VTI_IP> multihop on
set bgp external remote-as <SASE_AS> peer <PRIMARY_PEER_VTI_IP> graceful-restart on
set bgp external remote-as <SASE_AS> peer <PRIMARY_PEER_VTI_IP> export-routemap bgpout preference 100 onset bgp external remote-as <SASE_AS> peer <SECONDARY_PEER_VTI_IP> on
set bgp external remote-as <SASE_AS> peer <SECONDARY_PEER_VTI_IP> multihop on
set bgp external remote-as <SASE_AS> peer <SECONDARY_PEER_VTI_IP> graceful-restart on
set bgp external remote-as <SASE_AS> peer <SECONDARY_PEER_VTI_IP> export-routemap bgpout_sec preference 100 on

Step 5 - Save the Configuration

Run:

Copy 
save config

Notes:

  • The import route maps accept and rank the received routes. A separate inbound accept-all filter is not required.

  • The export route maps are the advertising mechanism. Do not also redistribute the LAN through a separate route-redistribution rule. This advertises the prefix a second time without the prepend and defeats the configuration.

  • Apply the AS prepend through the export route map. The peer-attribute form does not take effect and must not be used:

    Copy 
    set bgp external remote-as <SASE_AS> peer <SECONDARY_PEER_VTI_IP> aspath-prepend-count <N>

Verify on the Gateway

On a cluster, run the verification commands on the active member.

  • Run:

    Copy 
    show configuration bgp
                        show configuration routemaps

    Confirm that the import route maps contain the primary and secondary preference values, both peers reference their export route maps, and the secondary export route map contains action aspath-prepend-count.

  • Run:

    Copy 
    show bgp peers

    Confirm that both peers have the Established state. The secondary peer shows ActRts 0. Its routes are received but not selected because the import route map prefers the primary.

  • Run:

    Copy 
    show bgp peers adj-rib-out aspath

    Confirm that the LAN prefix shows a longer AS path to the secondary peer than to the primary peer. For example, with aspath-prepend-count 3, the primary receives the prefix with a single AS hop and the secondary receives it with the AS repeated three times.

  • Send bidirectional site-to-site traffic. Confirm that traffic is symmetric on the primary region. The response returns on the same tunnel on which the request arrived, and intermittent drops are gone.

  • Test failover. Disable the primary tunnel and confirm that traffic moves to the secondary region. Restore the primary tunnel and confirm that traffic returns to the primary region.

Validated Example

This example uses these lab values:

  • Primary region: Frankfurt

  • Primary peer: 169.254.100.100

  • Secondary region: Miami

  • Secondary peer: 169.254.200.100

  • LAN prefix: 50.50.50.0/24

  • Prepend count: 3

Replace the lab values with values from your environment. On a cluster, enter the commands identically on both members.

Copy 
set bgp external remote-as 64512 on
set bgp external remote-as 64512 import-routemap "sase_prim_in" preference 1 on
set bgp external remote-as 64512 import-routemap "sase_sec_in" preference 2 on
set bgp external remote-as 64512 peer 169.254.100.100 on
set bgp external remote-as 64512 peer 169.254.100.100 multihop on
set bgp external remote-as 64512 peer 169.254.100.100 graceful-restart on
set bgp external remote-as 64512 peer 169.254.100.100 export-routemap "bgpout" preference 100 on
set bgp external remote-as 64512 peer 169.254.200.100 on
set bgp external remote-as 64512 peer 169.254.200.100 multihop on
set bgp external remote-as 64512 peer 169.254.200.100 graceful-restart on
set bgp external remote-as 64512 peer 169.254.200.100 export-routemap "bgpout_sec" preference 100 onset routemap bgpout id 500 on
set routemap bgpout id 500 allow
set routemap bgpout id 500 match as 64512 on
set routemap bgpout id 500 match network 50.50.50.0/24 all
set routemap bgpout id 500 match protocol directset routemap bgpout_sec id 500 on
set routemap bgpout_sec id 500 allow
set routemap bgpout_sec id 500 match as 64512 on
set routemap bgpout_sec id 500 match network 50.50.50.0/24 all
set routemap bgpout_sec id 500 match protocol direct
set routemap bgpout_sec id 500 action aspath-prepend-count 3set routemap sase_prim_in id 10 on
set routemap sase_prim_in id 10 allow
set routemap sase_prim_in id 10 match neighbor 169.254.100.100 on
set routemap sase_prim_in id 10 action preference 1set routemap sase_sec_in id 10 on
set routemap sase_sec_in id 10 allow
set routemap sase_sec_in id 10 match neighbor 169.254.200.100 on
set routemap sase_sec_in id 10 action preference 50