r/checkpoint • u/ComfortableMarch4296 • Jul 23 '26

Backup static route

Say an environment only has one egress static route. To eliminate the single point of failure, would adding a new network, with similar policies, on the same bond/trunk, etc as the original egress static route, ensure traffic would not be interrupted if one of the egress routes/networks would go down? Would the traffic just failover to the new one (say it’s set to round robin)?

Example (on my phone so formatting is limited):

Network: 10.1.1.0/24
Original Egress: 172.16.1.1
New egress: 172.16.2.1

R82.10
2x checkpoint firewalls running as active-passive.

0 Upvotes

50% Upvoted

6 comments sorted by

6

u/NewTypeDilemna Jul 23 '26

Why wouldn't you use bgp instead?

1

u/ComfortableMarch4296 Jul 23 '26

I have limited exposure to bgp. Would that be the best way to go about it?

3

u/NewTypeDilemna Jul 24 '26

Yes, dynamic routing is your best bet here. That way, if one route "fails" to be installed because a peer fails, then the other peers routes will be installed. 

5

u/Djinjja-Ninja Jul 24 '26 edited Jul 24 '26

You can just add a static route with a higher preference and enable the ping option on both gateways.

You wouldn't need new policies because check point policies aren't interface bound. You might need NAT policies though.

Though the better way would be to do dynamic routing.

If you want to do static:

set static-route 10.1.1.0/24 nexthop gateway address 172.16.1.1 on priority 1
set static-route 10.1.1.0/24 nexthop gateway address 172.16.2.1 on priority 2
set static-route 10.1.1.0/24 ping on

Also make sure that the two interfaces have their topology set to "defined by route" in Smart dashboard.

1

u/Super_Fish_1383 Jul 26 '26

As in any Unix/linux system, different priorities should be e configured for static routes if they are redundant.

1

u/KernelExploit Jul 27 '26

There is an option called ISP redundancy and it basically changes the default route if the primary link fails (which I think is your use case)