Hi, all
We have an ISP with 2 links with BGP configuration (DS3 as primary link, 2 T1s as standby). We use Ckeck Point NG FP3 (Solaris 9, SPARC) with StoneBeat FullCluster to load balance NG. Since our Internet link is BGP configuration, two internet routers have the addresses lets say: 10.1.1.1 (virtual IP address), 10.1.1.2 (DS3 router IP address), 10.1.1.3 (T1 router IP address). The external NG interfaces which connect to internet routers will have lets say: 10.1.1.10 (virtual cluster IP address), 10.1.1.11 (FW module 1's physical IP address), 10.1.1.12 (FW module 2's physical IP address). In the standard NG and Stonebeat FullCluster configuration, NG points to internet router's virtual IP address as default router, internet routers point to NG cluster's virtual IP address as default router address. If we configure the NG cluster like this, all the Internet traffic will go through DS3 link while 2 T1 links sit there idle.
We'd like to utilize those 2 T1 link. Our ISP told us that if we can have another IP address then they can route certain Internet traffic such as VPN and mail through 2 T1s as default route instead of DS3 and fail over to DS3 in case 2 T1 link is down. I was told by StoneSoft support that StoneBeat support multiple virtual cluster IP addresses lets say I create 10.1.1.13 for external NG interfaces. Check Point support told me that Check Point never tested that way. I have to test it myself. I am think that for site to site VPN, I can work around with Solaris' routing table to route traffic through 2 T1 link for routing (i.e. if the other end of VPN access point is 192.1.1.10, I can try "route add host 192.1.1.10 10.1.1.13 1" from Solaris) but not sure about Check Point Firewall-1 NG. Is it possible? How is the rule set about the configuration if I want to route VPN through 2 T1s? Thanks.
internal network
____ _______
| | 10.1.1.11 10.1.1.2 | DS3 |
---------------------------------------|FW1|----------------------------| |---------------------------------------------| router |--------|
|____| | 10.1.1.10 (Cluster floating IP address) | |______| |
|-----------------------------------------------------------------------| 10.1.1.1(from router) |----------Internet
____ | 10.1.1.13 (2nd Cluster floating IP address | ______ |
| | 10.1.1.12 | wants to add) | 10.1.1.3| 2 T1 | |
---------------------------------------|FW2|----------------------------| |---------------------------------------------| router|---------|
|____| |_____|
Ryan Jiang
Senior UNIX administrator
Liz Claiborne, Inc.
(201) 295-7171
