sk98226 - Dynamic Routing and VRRP Features on Gaia OS
Dynamic Routing and VRRP Features on Gaia OS
Solution
New Gaia Dynamic Routing features by release
| Version | New Dynamic Routing Features |
| R82 | Added support for new Dynamic Routing capabilities: - BGP Extended Communities (RFC 4360). - BGP Conditional Route Advertisement and Injection. - Routing Table Monitor for EventClosed Triggers. - IPv4 and IPv6 Router Discovery on cluster members. - Router Preference and Route Information option. - Route age information. - IPv4 PIM-SSM with non-default prefixes. - IPv4 PIM with BFD. - IPv4 PIM neighbor filtering. - IPv4 PIM RPT to SPT switchover control. - IPv6 Protocol Independent Multicast (PIM) and Multicast Listener Discovery (MLD). Added support for new Dynamic Routing API calls: - REST API calls for BGP, PIM, Multicast Listener Discovery (MLD). - REST API calls for Route Redistribution, Inbound Route Filters, and NAT Pools. - REST API calls for IGMP. See the Check Point Gaia API Reference v1.8 (and higher) > section "Networking". |
| R81.20 | - Support for Intermediate System (IS-IS) routing protocol. - Support for DHCP Relay Agent Information Option 82 to address several scaling and security issues that arise in public DHCP use. - Support for OSPFv3 NSSA. - Support for IPv6 Static MFC Cache to enable forwarding of multicast data without PIM configuration. - Support for Routing Event Triggers to allow ClusterXL failover, and tearing down of BGP connections through monitored BGP and BFD sessions. - Routing Protocol History for BFD to improve troubleshooting capabilities. - NetFlow Live connections and Firewall rule. |
| R81.10 | - PIM Enhancements - Ability to clear OSPF error counters - OSPFv2 Graceful Restart in ClusterXL (RFC standard) - Static IGMP source-group pairs - ECMP support with different forwarding algorithms |
| R81 | - OSPFv3 AH authentication - support authentication for OSPFv3 protocol security - IPv6 route aggregation - support aggregating routes to reduce the number of prefixes advertised to neighbor routers, thus improving performance and scaling - IPv4 NAT-pool routes - support NAT with routing by configuring and redistributing NAT-pool routes to routing protocols - RIP route sync - re-implement RIP route sync in the standard way like the other routing protocols - PIM restart - adds PIM to protocols that have user restarts - BGP Support for VxLAN interfaces - Dynamic Routing support for GRE interfaces |
| R80.40 | - Protocol Restart for BGP and OSPF: - Protocols can be restarted in Gaia Portal or Gaia Clish - PBR in VSX: - Enables users to configure PBR rules and tables in a VS Context - BGP Enhanced Route Refresh: - Enables support for Enhanced Route Refresh as per RFC 7313 - Gets enabled automatically when route-refresh is enabled |
| R80.30 | - IP Reachability MultiHop detection with ICMP and BFD: - Multihop Ping and Multiple ISPs in Policy-Based Routing. - Multihop Ping in Static Routes. - BFD in Static Routes. - VSX VSID in Netflow. |
| R80.20 | - AllowAS-in-count - OSPF v2/v3 Multiple Instances - BGP IPv6 MD5 - OSPFv3 support in ClusterXL, including Link-Local VIP - BFD support for BGP and OSPF (IPv4 and IPv6) |
| R80.10 | - BGP 4-Byte AS Number - Local AS Number - AS Override - IPv6 DHCP Relay - IPv6 RIPng with VRRPv3 - Route Redistribution and inbound Route Filtering CLI - OSPF Forced Hello - ECMP for iBGP - SNMP for RIP, OSPF, BGP, PIM, VRRPv2 (IPv4 only) - Show Config for BGP and Route Redistribution - BGP route filtering and AS range - BGP communities regexp The R80.10 Advanced Routing and Clustering Enhancement Hotfix includes these same R80.20 Dynamic Routing features (along with R80.20 ClusterXL features). For more information about this hotfix, see sk122654. |
| R77.30 | - OSPF Graceful Restart (supported for IPv4 with VRRP-only). In R80.20, IPv6, VSX and ClusterXL have been added. - OSPFv2 and ClusterXL inter-monitoring (supported for IPv4, single Security Gateway, VSX and ClusterXL. In R80.20, IPv6, VSX and ClusterXL have been added. - Static Multicast Routes (supported for IPv4, single Security Gateway, VSX, VRRP cluster, and ClusterXL. (IPv6 is not supported). - Routing configuration support in Gaia Cloning Groups ( cadmin). - PBR with Destination Port and Service - see sk100500 (supported for IPv4, single Security Gateway, ClusterXL and VRRP. (IPv6 and VSX are not supported). |
| R77.20 | - New and improved handling of DHCP. See sk98839 for more information on procedures for setting up DHCP on a Security Gateway, including: - DHCP Relay - DHCP Server - DHCP Relay + DHCP Server Legacy DHCP configuration (as supported in versions R77.10 and lower) can also be used on R77.20, if needed. - BGP Graceful Restart (IPv4 and IPv6, Security Gateway mode and VSX mode) |
| R77.10 | - BGP ECMP (IPv4 and EBGP only, Security Gateway mode and VSX mode) - BGP Nexthop (Peer) monitoring (IPv4 and IPv6, Security Gateway mode and VSX mode) - Netflow support for VSX - ping6 for IPv6 Static Routes - Configuration of VRRP SNMP traps - Stability and Usability fixes - OSPF Tag Matching - Support for DNS option in IPv6 Router Advertisements |
| R77 | - SNMP OIDs for VRRPv2 - Routing configuration support in Gaia Cloning Groups ( cadmin) |
Feature Support as of R80.20 Release
Routing:
Enter the string to filter this table:
| Routing Protocol or Feature |
Support in Gateway Mode |
Support in VSX Mode |
| OSPF | - OSPF v3 for IPv6: Supported on Security Gateway, ClusterXL and VRRPv3 Cluster - OSPF v2 for IPv4 (RFC 2328): Supported on Security Gateway, ClusterXL and VRRPv3 Cluster - Intermonitoring with ClusterXL from R77.30 - OSPF v2 / OSPF v3 with Multiple Instances - BFD support (OSPF v2 / OSPF v3) |
- OSPFv2 (IPv4) and OSPFv3 (IPv6) - ClusterXL only (VRRP is not supported) - Numbered warp interfaces: Not supported. - Intermonitoring with VSX Cluster from R77.30 - OSPF v2 / OSPF v3 with Multiple Instances - BFD Support (OSPF v2 / OSPF v3) |
| BGP for IPv4 | - BGP for IPv4 (RFC 1771): Supported on Security Gateway, ClusterXL and VRRPv2 Cluster - BGP IPv6: Multiprotocol Extension Capability on Security Gateway and VRRPv3 Cluster (ClusterXL is not supported) - BGP IPv6 MD5 authentication supports 4-byte AS Number, local-AS and AS-override, AllowAS-in-count, - BFD support for IPv4 and IPv6 |
- BGP IPv4 and IPv6: Supported on VSX Gateway and VSX Cluster - BGP IPv6 MD5 authentication supports 4-byte AS Number, local-AS and AS-override, AllowAS-in-count. - BFD support for IPv4 and IPv6 |
| PIM (RFC 4601 and RFC 3973) | - PIM for IPv4: Sparse Mode, Dense Mode, Source Specific Multicast, IGMPv2, IGMPv3 - on Security Gateway, ClusterXL and VRRPv2 Cluster - PIM for IPv6: Not supported |
- PIM for IPv4: Sparse Mode, Dense Mode, Source Specific Multicast, IGMPv2, IGMPv3 - on VSX Gateway and VSX Cluster - Numbered warp interfaces: Not supported. - PIM for IPv6: Not supported |
| RIP for IPv4 | - RIP for IPv4: Supported on Security Gateway, ClusterXL and VRRPv2 Cluster - RIPng for IPv6: Supported from R80.10 |
- RIP for IPv4: VSX Gateway and VSX Cluster - Numbered warp interfaces: Not supported. - RIPng for IPv6: Not supported |
| Policy-Based Routing (PBR) | - PBR for IPv4: Based on Source IP, Destination IP and Interface. ECMP is supported. ClusterXL and VRRPv2 Cluster and are supported. - Destination Port and Protocol are supported as of R77.30 - PBR for IPv6: Not supported - ISP Redundancy: Not supported |
- PBR for IPv4: Based on Source IP, Destination IP and Interface. ECMP is supported. VSX Gateway and VSX Cluster are supported. - PBR for IPv6: Not supported - PBR with Destination Port and Protocol are not supported in VSX mode due to configuration limitation - ISP Redundancy: Not supported |
| IP Broadcast Helper | For IPv4 only | For IPv4 only |
| DHCP Relay | For IPv4 and IPv6 | For IPv4 and IPv6 |
| Router Discovery | For IPv4 and IPv6 IPv6 Router Discovery works on Security Gateway and in ClusterXL. IPv4 Router discovery is not supported in ClusterXL (supported only on Security Gateway, or in VRRP cluster). |
For IPv4 and IPv6 IPv6 Router Discovery is supported on VSX Gateway and VSX Cluster. Note: IPv4 Router Discovery is not supported in VSX Cluster (supported only on VSX Gateway) |
| Inbound Route Filtering | - IPv4: All protocols - IPv6: All protocols |
- IPv4: All protocols - IPv6: All protocols |
| Route Redistribution | For IPv4 and IPv6 | For IPv4 and IPv6 |
| Route Aggregation | For IPv4 only | For IPv4 only |
| ICMP | For IPv4 and IPv6 | For IPv4 and IPv6 |
| ECMP | For IPv4 only - OSPF - BGP - eBGP from R77.10 - iBGP from R80.10 |
For IPv4 only - OSPF - BGP - eBGP from R77.10 - iBGP from R80.10 |
| Graceful Restart Helper | For IPv4 and IPv6 - Supported: - BGP for IPv4 - BGP for IPv6 - OSPF v2 for IPv4 - OSPF v3 for IPv6 |
For IPv4 and IPv6 - Supported: - BGP for IPv4 - BGP for IPv6 - OSPF v2 for IPv4 - OSPF v3 for IPv6 |
| Graceful Restart Restarter | - BGP for IPv4 and IPv6: Not supported - OSPF v2 for IPv4 and OSPF v3 for IPv6: Not supported on Security Gateway and ClusterXL - OSPF v2 for IPv4: Supported on VRRP cluster |
- BGP for IPv4 and IPv6: Supported - OSPF v3 for IPv6: Supported - OSPF v2 for IPv4: Not supported |
| Static Multicast Routes | For IPv4 - from R77.30 on Security Gateway, ClusterXL, and VRRP Cluster | For IPv4 - from R77.30 on VSX Gateway and VSX Cluster |
VRRP
Refer to sk105170 - Configuration requirements / considerations and limitations for VRRP cluster on Gaia OS
| Feature | Gateway Mode | VSX Mode |
| IPv4 | - VRRPv2 - Supports Monitored Circuits, Non-preempt, Auto-deactivation, Simplified VRRP Configurations (MCVR) - RIP - OSPF v2 and OSPF v2 Graceful Restart - BGP - PIM |
VRRP is not supported in VSX Mode. VSX uses ClusterXL only. |
| IPv6 | - VRRPv3 - Supports Monitored Circuits, Non-preempt. - OSPFv3 - BGP with multiprotocol support - RIPng from R80.10 |
|
| VRRPv3 | - PIM, Simplified VRRP Configuration and Auto-deactivation are not yet supported. |
Administration Guides:
How-To Documents:
OSPF
BGP
- sk95967 - BGP on Gaia OS
- sk100499 - BGP on Gaia OS - configuring Graceful Restart
- sk100504 - How to configure Equal Cost Multipath (ECMP) over eBGP on Gaia
PIM
DHCP / DHCP Relay
- sk98839 - Configuration of IPv4 BOOTP/DHCP Relay using legacy services
- sk104114 - Configuration of IPv4 BOOTP/DHCP Relay using new services
IP Broadcast Helper
Routing Policy Configuration
- sk98936 - How to configure route redistribution and inbound route filters in Gaia Portal
- sk100501 - How to configure Routemaps in Gaia Clish
Policy Based Routing
General Limitations and Notes regarding Dynamic Routing and VRRP (also see the Release Notes for your version)
- Use of Advanced VRRP Configuration in cases of multiple VRRP interfaces: Use of Advanced VRRP configuration is recommended when there are many VRRP interfaces (> 10). Use of VRRP (a.k.a. "mcvr") may result in very slow response in configuring due to the large number of VRRP configuration bindings.
- Route Redistribution and Inbound Router Filters vs. Routemaps:
There are two ways to configure routing policy
- Route Redistribution and Inbound Router Filters (available in Gaia Portal only in versions R77.30 and lower, and in Gaia Clish from R80.10)
- Routemaps (available in Gaia Clish only)
The two methods have different capabilities and different levels of integration with protocol-specific features. Routemaps are generally more capable but require all granularity to be configured within them. Also, if a Routemap is associated with a protocol (RIP/OSPF/BGP), it will take precedence over any Route Redistribution/Inbound Route Filters/protocol-specific features.
For example:
Route Redistribution can be used to advertise certain routes with a specific MED to all BGP peers belonging to the same AS. Peer-specific configuration (med-out) can be used to advertise a different MED to one or more peers within the same AS. For those peers, med-out replaces the MED configured via Route Redistribution.
If a Routemap is also configured to advertise routes to BGP peers within the same AS, all Route Redistribution and peer-specific configuration is ignored. The Routemap must be configured completely to ensure that the required routes are advertised to all the peers with the MED desired. A peer-specific Routemap would need to be configured to advertise a different MED to a specific peer (see sk110477).
Article Properties
Access Level: General
Status: Approved
Date Created: 2014-01-17
Last Modified: 2026-07-08
Was this page helpful? Yes / No