Pages

Sunday, October 24, 2010

Source-based routing in Checkpoint VSX

Recently I was testing Checkpoint VSX. In the checkpoint documentation they said that you can do source based routing in VSX, but this is with the Virtual Routers that they provide. Source-based routing works well when you put a Internal Virtual Router (IVR).
In an earlier post I mentioned how to do source-based routing in Linux using 'iproute2'. The good news is that you can use the same concept in the VSX virtualized environment.
In VSX each and every virtual device is associated with a VRF (Virtual Routing and Forwarding) instance. So the good news here is that, you have a routing instance running for each and every virtual device you have created.
Routing table entries are made only in one file, that is common for all the virtual systems, '/etc/iprotue2/rt_tables'. You can place the routing table number and give an alias for that. After you have created a routing table entry you can use that table in a VRF.
The two important commands that is used in iproute2 environment are
ip rule
ip route
First of all you have to add a rule saying, Traffic originating from this source should lookup the table you have created. Say that you have created a table called 'customerA', and you want traffic originating from 10.10.10.0/24 subnet to lookup the table 'customerA', and this should reside on vrf 2. For this you simply execute the command,
ip rule add from 10.10.10.0/24 via table customerA vrf 2
Now its time to add the routing entries for the table. For this you can use the same syntax you have used for normal iproute2 environment, that is without vrf, additionally you have to specify the vrf number. So for the default gateway it should look like,
ip route add default via 192.168.1.1 table customerA vrf 2
That's it. Very simple isn't it!

No comments: