cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
383
Views
0
Helpful
8
Replies
Beginner

Configure Static Route on a Virtual IP

Hello,

 

I have a router point to 2 firewalls in a high availability cluster (Checkpoint firewall).

 

The firewall cluster has a virtual IP.

 

I need to configure a static route on my router when the virtual IP on the firewall in the outgoing IP (i.e ip route 10.x.x.x 255.255.255.0 [virtual ip] ). 


However, this is not working as my packet keeps dropping. The cisco router is not seeing this virtual ip.

 

Is there a way to include a virtual ip in a static route?

 

Thank you

 

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Beginner

Re: Configure Static Route on a Virtual IP

Since you are able to ping Firewall VIP so ideally this static route should work, check your firewall end for possible routing issues over VIP.

 

https://community.checkpoint.com/t5/Enterprise-Appliances-and-Gaia/Vip-ip-issue/td-p/23361

Please Rate Posts (by clicking on Star) and/or Mark Solutions as Accepted, when applies

View solution in original post

8 REPLIES 8
Highlighted
VIP Expert

Re: Configure Static Route on a Virtual IP

Hi,

There is no concept of virtual IP for the Cisco routers. So, the command you posted here (i.e ip route 10.x.x.x 255.255.255.0 [virtual ip of the firewall] ) is correct. Can you ping the IP address of the firewall? Can the firewall ping the IP address of the Cisco router?

HTH

Highlighted
Beginner

Re: Configure Static Route on a Virtual IP

The router can ping the virtual ip of the firewall. The firewall also can ping the router (individually of course)

However when i add the virtual ip in the static route, it drops the packet.

 

If i try to add a static route to 1 of the firewall in the cluster, it works. But i dont want this, i want it to hit the ACTIVE firewall. To hit the ACTIVE firewall, it needs the virtual IP.

 

Can you help please ?

Highlighted
VIP Expert

Re: Configure Static Route on a Virtual IP

So, you have 2 firewalls in cluster mode and one Cisco router? Are both firewalls physically connected to the router? Not familiar with the firewall but what type of Cisco device is that? Can you post the router config (sh run) and point out the interfaces connected to the firewalls?

HTH

Highlighted
Beginner

Re: Configure Static Route on a Virtual IP

I have 2 checkpoint firewalls (per say FW-01 and FW-01 with ip 192.168.1.1/24 & 192.168.1.2/24 with virtual ip 192.168.1.3/24). Since the cluster is in High availability, one firewall will be on ACTIVE mode and the other on STANDBY. If the active goes down, the standby becomes active instantly. That's why i need to use the virtual IP rather than individual IPs of the firewall because the virtual ip will redirect to the ACTIVE firewall.

 

Now the config of my router:

MRU-ROUTER-CE#show run
Building configuration...

*Feb 14 18:11:35.619: %SYS-5-CONFIG_I: Configured from console by console
Current configuration : 4440 bytes
!
! Last configuration change at 18:11:35 UTC Fri Feb 14 2020
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname MRU-ROUTER-CE
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 $1$rUmt$FV9hZ.I754QD0Z/c.Lcag1
!
no aaa new-model
ethernet lmi ce
!
!
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
no ip domain lookup
ip domain name th3pl4gu3.com
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
username admin secret 5 $1$BYsm$t829Rly3tUUHhrYpI62oV1
username mervin secret 5 $1$KSy6$UGm.q22xrSfaOShznYCwl/
!
redundancy
!
no cdp log mismatch duplex
!
ip tcp synwait-time 5
!
!
!
!
!
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
description Link to INTERNET
ip address 172.30.43.70 255.255.255.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/1
description Link to Mauritius Port-Louis Network
ip address 192.168.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/2
description Link to Mauritius Rose Hill Network
ip address 172.16.20.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/3
no ip address
shutdown
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/4
no ip address
shutdown
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/5
no ip address
shutdown
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/6
no ip address
shutdown
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/7
no ip address
shutdown
duplex auto
speed auto
media-type rj45
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip nat inside source list ACL_NAT interface GigabitEthernet0/0 overload
ip nat inside source static 172.16.0.10 172.30.43.71
ip route 0.0.0.0 0.0.0.0 172.30.43.3
ip route 10.0.0.0 255.255.255.0 192.168.1.3
ip route 172.16.0.0 255.255.255.0 192.168.1.1
ip route 172.16.0.0 255.255.255.0 192.168.1.2
ip ssh version 2
!
ip access-list standard ACL_NAT
permit 192.168.1.0 0.0.0.255
permit 10.0.0.0 0.0.0.255
!
!
!
!
control-plane
!
banner exec ^C
**************************************************************************
* IOSv is strictly limited to use for evaluation, demonstration and IOS *
* education. IOSv is provided as-is and is not supported by Cisco's *
* Technical Advisory Center. Any use or disclosure, in whole or in part, *
* of the IOSv Software or Documentation to any third party for any *
* purposes is expressly prohibited except as otherwise authorized by *
* Cisco in writing. *
**************************************************************************^C
banner incoming ^C
**************************************************************************
* IOSv is strictly limited to use for evaluation, demonstration and IOS *
* education. IOSv is provided as-is and is not supported by Cisco's *
* Technical Advisory Center. Any use or disclosure, in whole or in part, *
* of the IOSv Software or Documentation to any third party for any *
* purposes is expressly prohibited except as otherwise authorized by *
* Cisco in writing. *
**************************************************************************^C
banner login ^C
**************************************************************************
* IOSv is strictly limited to use for evaluation, demonstration and IOS *
* education. IOSv is provided as-is and is not supported by Cisco's *
* Technical Advisory Center. Any use or disclosure, in whole or in part, *
* of the IOSv Software or Documentation to any third party for any *
* purposes is expressly prohibited except as otherwise authorized by *
* Cisco in writing. *
**************************************************************************^C
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login local
transport input ssh
!
no scheduler allocate
!
end

 

Version of IOS: 15.6(2)T

Interface G0/1 is facing the firewall.

 

10.0.0.0 /24 is the network that i want to reach through the virtual ip of the firewall.

 

Hope this helps...

 

Highlighted
Beginner

Re: Configure Static Route on a Virtual IP

My configuration on the router is:

 

MRU-ROUTER-CE#show run
Building configuration...

*Feb 14 18:11:35.619: %SYS-5-CONFIG_I: Configured from console by console
Current configuration : 4440 bytes
!
! Last configuration change at 18:11:35 UTC Fri Feb 14 2020
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname MRU-ROUTER-CE
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 $1$rUmt$FV9hZ.I754QD0Z/c.Lcag1
!
no aaa new-model
ethernet lmi ce
!
!
!
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
no ip icmp rate-limit unreachable
!
!
!
!
!
!
no ip domain lookup
ip domain name th3pl4gu3.com
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
username admin secret 5 $1$BYsm$t829Rly3tUUHhrYpI62oV1
username mervin secret 5 $1$KSy6$UGm.q22xrSfaOShznYCwl/
!
redundancy
!
no cdp log mismatch duplex
!
ip tcp synwait-time 5
!
!
!
!
!
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
description Link to INTERNET
ip address 172.30.43.70 255.255.255.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/1
description Link to Mauritius Port-Louis Network
ip address 192.168.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/2
description Link to Mauritius Rose Hill Network
ip address 172.16.20.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/3
no ip address
shutdown
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/4
no ip address
shutdown
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/5
no ip address
shutdown
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/6
no ip address
shutdown
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/7
no ip address
shutdown
duplex auto
speed auto
media-type rj45
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip nat inside source list ACL_NAT interface GigabitEthernet0/0 overload
ip nat inside source static 172.16.0.10 172.30.43.71
ip route 0.0.0.0 0.0.0.0 172.30.43.3
ip route 10.0.0.0 255.255.255.0 192.168.1.3
ip route 172.16.0.0 255.255.255.0 192.168.1.1
ip route 172.16.0.0 255.255.255.0 192.168.1.2
ip ssh version 2
!
ip access-list standard ACL_NAT
permit 192.168.1.0 0.0.0.255
permit 10.0.0.0 0.0.0.255
!
!
!
!
control-plane
!
banner exec ^C
**************************************************************************
* IOSv is strictly limited to use for evaluation, demonstration and IOS *
* education. IOSv is provided as-is and is not supported by Cisco's *
* Technical Advisory Center. Any use or disclosure, in whole or in part, *
* of the IOSv Software or Documentation to any third party for any *
* purposes is expressly prohibited except as otherwise authorized by *
* Cisco in writing. *
**************************************************************************^C
banner incoming ^C
**************************************************************************
* IOSv is strictly limited to use for evaluation, demonstration and IOS *
* education. IOSv is provided as-is and is not supported by Cisco's *
* Technical Advisory Center. Any use or disclosure, in whole or in part, *
* of the IOSv Software or Documentation to any third party for any *
* purposes is expressly prohibited except as otherwise authorized by *
* Cisco in writing. *
**************************************************************************^C
banner login ^C
**************************************************************************
* IOSv is strictly limited to use for evaluation, demonstration and IOS *
* education. IOSv is provided as-is and is not supported by Cisco's *
* Technical Advisory Center. Any use or disclosure, in whole or in part, *
* of the IOSv Software or Documentation to any third party for any *
* purposes is expressly prohibited except as otherwise authorized by *
* Cisco in writing. *
**************************************************************************^C
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login local
transport input ssh
!
no scheduler allocate
!
end

 

The IOS version is 15.6

The interface facing towards the router is G0/1

 

I have 2 Physical Firewall in cluster. (let's say FW-01 (192.168.1.1) & FW-02 (192.168.1.2))
Since the cluster is configured in High Availability mode, one is ACTIVE and the other is in standby.
The virtual ip will redirect the traffic to the active firewall always.
That's why i need the virtual ip in the static route instead of individual firewall IPs.

Highlighted
Beginner

Re: Configure Static Route on a Virtual IP

Since you are able to ping Firewall VIP so ideally this static route should work, check your firewall end for possible routing issues over VIP.

 

https://community.checkpoint.com/t5/Enterprise-Appliances-and-Gaia/Vip-ip-issue/td-p/23361

Please Rate Posts (by clicking on Star) and/or Mark Solutions as Accepted, when applies

View solution in original post

Highlighted
Beginner

Re: Configure Static Route on a Virtual IP

It was an issue on virtual MAC!
Thank you so much for this post!

Highlighted
VIP Expert

Re: Configure Static Route on a Virtual IP

I have 2 Physical Firewall in cluster. (let's say FW-01 (192.168.1.1) & FW-02 (192.168.1.2)

That's why i need the virtual ip in the static route instead of individual firewall IPs

The virtual IP should be configured on the firewalls first before it can be added to the router

So, on the firewall:

FW-01 192.168.1.1

FW-02 192.168.1.2

Virtual IP 192.168.1.3

on the router:

 

ip route <ip and mask> 192.168.1.3 

I think you already have this on the router

HTH

 

 

 

 

CreatePlease to create content
Content for Community-Ad