Configuring Link State Propagation (LSP)

On Check Point Appliances that run as a Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. or ClusterXL ClusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. Members, you can bind together in Bridge ModeClosed Security Gateway or Virtual System that works as a Layer 2 bridge device for easy deployment in an existing topology. two physical ports on a Check Point Expansion Line Card.

When the link state for one bridged subordinate port goes down, the other bridged subordinate port also goes down.

Switch detects and reacts faster to a link failure on the other side of a bridge or another part of the network.

Link State Propagation is supported on Check Point Appliances with these Expansion Line Cards:

Line Card SKU

Description

Driver

CPAC-4-1C

4 Port 10/100/1000 Base-T Ethernet (RJ45) interface card

IGB

CPAC-8-1C

8 Port 10/100/1000 Base-T Ethernet (RJ45) interface card

IGB

CPAC-4-1F

4 Port 1000 Base-F Fiber (SFP) interface card

IGB

CPAC-4-10F

4 Port 10G Base-F Fiber (SFP+) interface card

IXGBE

You can configure the Link State Propagation in one of these modes:

LSP Mode

Description

Automatic port detection and port pair creation

Security Gateways and Cluster Members automatically assign all bridged ports to port pairs.

Manual port pair creation

You manually configure the assignment of bridged ports to port pairs.

Note - You can configure up to four port pairs.

Important:

  • In a Cluster, you must configure all the Cluster Members in the same way.

  • Link State Propagation does not support Bond interfaces.

Step

Instructions

1

Connect to the command line on the Security Gateway or each Cluster MemberClosed Security Gateway that is part of a cluster..

2

Log in to the Expert mode.

3

Back up the current $FWDIR/boot/modules/fwkern.conf file:

cp -v $FWDIR/boot/modules/fwkern.conf{,_BKP}

If this file does not exist, create it:

touch $FWDIR/boot/modules/fwkern.conf

4

Edit the current $FWDIR/boot/modules/fwkern.conf file:

vi $FWDIR/boot/modules/fwkern.conf

5

Add this line:

fw_link_state_propagation_enabled=1

6

Save the changes in the file and exit the Vi editor.

7

Reboot the Security Gateway or each Cluster Member.

8

Make sure the Security Gateway or Cluster Members loaded the new configuration:

fw ctl get int fw_link_state_propagation_enabled

The returned output must show:

fw_link_state_propagation_enabled = 1

Step

Instructions

1

Connect to the command line on the Security Gateway or each Cluster Member.

2

Log in to the Expert mode.

3

Back up the current $FWDIR/boot/modules/fwkern.conf file:

cp -v $FWDIR/boot/modules/fwkern.conf{,_BKP}

If this file does not exist, create it:

touch $FWDIR/boot/modules/fwkern.conf

4

Edit the current $FWDIR/boot/modules/fwkern.conf file:

vi $FWDIR/boot/modules/fwkern.conf

5

Add these lines (you can configure up to four LSP pairs):

fw_link_state_propagation_enabled=1

fw_manual_link_state_propagation_enabled=1

fw_lsp_pair1="<interface_name_1,interface_name_2>"

fw_lsp_pair2="<interface_name_3,interface_name_4>"

fw_lsp_pair3="<interface_name_5,interface_name_6>"

fw_lsp_pair4="<interface_name_7,interface_name_8>"

Example:

fw_lsp_pair1="eth1,eth2"
fw_lsp_pair2="eth3,eth4"

6

Save the changes in the file and exit the Vi editor.

7

Reboot the Security Gateway or each Cluster Member.

8

Make sure the Security Gateway or Cluster Members loaded the new configuration:

  1. Output of this command

    fw ctl get int fw_link_state_propagation_enabled

    must return

    fw_link_state_propagation_enabled = 1

  2. Output of this command

    fw ctl get int fw_manual_link_state_propagation_enabled

    must return

    fw_manual_link_state_propagation_enabled = 1

  3. Output of this command

    fw ctl get str fw_lsp_pair1

    must return the names of the interfaces configured in this pair

    <interface_name_1,interface_name_2>

  4. Output of this command

    fw ctl get str fw_lsp_pair2

    must return the names of the interfaces configured in this pair

    <interface_name_3,interface_name_4>

  5. Output of this command

    fw ctl get str fw_lsp_pair3

    must return the names of the interfaces configured in this pair

    <interface_name_5,interface_name_6>

  6. Output of this command

    fw ctl get str fw_lsp_pair4

    must return the names of the interfaces configured in this pair

    <interface_name_7,interface_name_8>

For more information:

See sk108121: How to configure Link State Propagation (LSP) in a Bridge interface on Gaia OS and SecurePlatform OS.