CheckPoint [LAB 1.6] Configuration BGP between Checkpoint and Cisco

gani · 15/09/2021

Topology:

Descreption:

CP1	VPC1	CP2	VPC2	CISCO	VPCTEST
eth0=MGMT:10.123.163.61		eth0=MGMT:10.123.163.62
eth1=EXT:10.123.160.61		eth1=EXT:10.123.160.62		gi0/0:10.123.160.254	10.123.160.101
eth2=INT:10.16.31.61	10.16.31.111	eth2=INT:10.16.31.62	10.16.32.222	lo0=INTERNET:8.8.8.8

Configuration:
1.Config IP

1.1 CISCO

interface GigabitEthernet0/0
no switchport
ip address 10.123.160.254 255.255.255.0
interface Loopback1
ip address 8.8.8.8 255.255.255.255

1.2 Checkpoint (by GUI or CLI)

CP1	CP2
set interface eth0 state on set interface eth0 ipv4-address 10.123.163.61 mask-length 24 set interface eth1 state on set interface eth1 ipv4-address 10.123.160.61 mask-length 24 set interface eth2 state on set interface eth2 ipv4-address 10.16.31.61 mask-length 24	set interface eth0 state on set interface eth0 ipv4-address 10.123.163.62 mask-length 24 set interface eth1 state on set interface eth1 ipv4-address 10.123.160.62 mask-length 24 set interface eth2 state on set interface eth2 ipv4-address 10.16.31.62 mask-length 24

2. Configuration BGP

2.1 CISCO

router bgp 3
bgp log-neighbor-changes
network 8.8.8.8 mask 255.255.255.255
network 10.123.160.0 mask 255.255.255.0
neighbor 10.123.160.61 remote-as 1
neighbor 10.123.160.62 remote-as 2

2.2 Checkpoint (by CLI)

CP1	CP2
set as 1 set bgp external remote-as 2 on set bgp external remote-as 2 peer 10.123.160.62 on set bgp external remote-as 3 on set bgp external remote-as 3 peer 10.123.160.254 on	set as 2 set bgp external remote-as 1 on set bgp external remote-as 1 peer 10.123.160.61 on set bgp external remote-as 3 on set bgp external remote-as 3 peer 10.123.160.254 on

3. Configuration Policy for BGP Protocol
4. Check BGP status (peer/neighbor, ....)

CP1	CP2	CISCO

5. Route redistribution in bgp

	CP1	CP2
CLI	set route-redistribution to bgp-as 2 from interface eth2 on set route-redistribution to bgp-as 3 from interface eth2 on	set route-redistribution to bgp-as 1 from interface eth2 on set route-redistribution to bgp-as 3 from interface eth2 on
GUI

6. Configuration Inbound Route Filters (Default Checkpoint reject BGP route)

	CP1	CP2
CLI	set inbound-route-filter bgp-policy 512 based-on-as as 2 on set inbound-route-filter bgp-policy 512 accept-all-ipv4 set inbound-route-filter bgp-policy 513 based-on-as as 3 on set inbound-route-filter bgp-policy 513 accept-all-ipv4	set inbound-route-filter bgp-policy 512 based-on-as as 1 on set inbound-route-filter bgp-policy 512 accept-all-ipv4 set inbound-route-filter bgp-policy 513 based-on-as as 3 on set inbound-route-filter bgp-policy 513 accept-all-ipv4
GUI