Configuring ISP Redundancy on a Cluster

  1. Connect with SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to the Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. or Domain Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. that manages this ClusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing..

  2. From the left navigation panel, click Gateways & Servers.

  3. Open the Cluster object.

  4. Click Other > ISP Redundancy.

  5. Select Support ISP Redundancy.

  6. Select the redundancy mode - Load SharingClosed A redundant cluster mode, where all Cluster Members process all incoming traffic in parallel. For more information, see "Load Sharing Multicast Mode" and "Load Sharing Unicast Mode". Synonyms: Active/Active, Load Balancing mode. Acronym: LS. or Primary/Backup.

  7. Configure the ISP Links.

    Make sure you have the ISP data - the speed of the link and next hop IP address.

    Automatic vs Manual configuration:

  8. Configure the Cluster to be the DNS server.

    The Cluster, or a DNS server behind it, must respond to DNS queries.

    It resolves IP addresses of servers in the DMZ (or another internal network).

    Get a public IP address from each ISP.

    If public IP addresses are not available, register the domain to make the DNS server accessible from the Internet.

    The Cluster intercepts DNS queries "Type A" for the web servers in its domain that come from external hosts.

    To enable the DNS server:

    1. Click Other > ISP Redundancy.

    2. Select Enable DNS Proxy.

    3. Click Configure.

    4. Add your DMZ or Web servers. Give each server two public IP addresses - one from each ISP.

    5. In the DNS TTL, enter a number of seconds.

      This sets a Time To Live for each DNS reply.

      DNS servers in the Internet cannot cache your DNS data in the reply for longer than the TTL.

    6. Click OK.

    7. Configure Static NAT to translate the public IP addresses to the real server's IP address.

      External clients use one of the two IP addresses.

      Note - If the servers use different services (for example, HTTP and FTP), you can use NAT for only two public IP addresses.

    8. Define an Access Control Policy ruleClosed Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session.:

      Name

      Source

      Destination

      VPN

      Services & Applications

      Action

      Track

      Install On

      DNS Proxy

      Applicable sources

      Applicable DNS Servers

      Any

      domain_udp

      Accept

      None

      Policy Targets

    To register the domain and get IP addresses:

    1. Register your domain with the two ISP.

    2. Tell the ISP the two IP addresses of the DNS server that respond to DNS queries for the domain.

    3. For each server in the DMZ, get two public IP addresses, one from each ISP.

    4. In SmartConsole, click Menu > Global properties.

    5. From the left tree, click NAT - Network Address Translation.

    6. In the Manual NAT rules section, select Translate destination on client side.

    7. Click OK.

  9. Configure the Access Control Policy for ISP Redundancy.

    The Access Control Policy must allow connections through the ISP links, with Automatic Hide NAT on network objects that start outgoing connections.

    1. In the properties of the object for an internal network, select NAT > Add Automatic Address Translation Rules.

    2. Select Hide behind the gateway.

    3. Click OK.

    4. Define rules for publicly reachable servers (Web servers, DNS servers, DMZ servers).

      • If you have one public IP address from each ISP for the Cluster, define Static NAT.

        Allow specific services for specific servers.

        For example, make NAT rules, so that incoming HTTP connections from the two ISPs reach a Web server, and DNS traffic from the ISP reach the DNS server.

        Example: Manual Static Rules for a Web Server and a DNS Server

        Original Source

        Original Destination

        Original Services

        Translated Source

        Translated Destination

        Translated Services

        Install On

        Comment

        Any

        Host object with IP address of Web Server

        http

        = Original

        S 50.50.50.2

        = Original

        Policy Targets

        Incoming Web - ISP A

        Any

        Host object with IP address of Web Server

        http

        = Original

        S 60.60.60.2

        = Original

        Policy Targets

        Incoming Web - ISP B

        Any

        Host object with IP address of DNS Server

        domain_udp

        = Original

        S 50.50.50.3

        = Original

        Policy Targets

        Incoming DNS - ISP A

        Any

        Host object with IP address of DNS Server

        domain_udp

        = Original

        S 60.60.60.3

        = Original

        Policy Targets

        Incoming DNS - ISP B

      • If you have a public IP address from each ISP for each publicly reachable server (in addition to the Cluster), define NAT rules:

        1. Give each server a private IP address.

        2. Use the public IP addresses in the Original Destination.

        3. Use the private IP address in the Translated Destination.

        4. Select Any as the Original Service.

    Note - If you use Manual NAT, then automatic ARP does not work for the IP addresses behind NAT. You must configure the local.arp file as described in sk30197.

  10. Install the Access Control Policy on this Cluster object.