F5 Positioning between 2 Firewalls (checkpoint and fortinet)

Question

Hi, I would like to ask if its possible to position the f5 inline between firewalls.
Point to point connections.&nbsp;
FW1---F5---FW2&nbsp;
Each segment is separated by 2 vlans vlan 56 connecting on FW1 and vlan 58 on FW2. By the way they are connected through a switch.&nbsp;
What do I need to configure on F5 side. Routes? Wildcard VS? I am load balancing servers behind FW2. And there are clients and servers behind FW1 that needs to communicate with the servers behind FW2.what policies need to be configured?&nbsp;
Any suggestions?&nbsp;

k20 · Answer

Clients---FW1-----(VIP)F5----FW2----Servers
Clients---FW1-----F5(VIP)----FW2----Servers&nbsp;
You can have either side of the F5 to be your virtual servers. Which FW is a default gateway for your F5?&nbsp;
If FW1 is a default gateway, you need a static route on the F5 to get to the servers with the next hop being the IP on FW2 facing the F5.&nbsp;
If FW2 is a default gateway, you need the traffic from the servers can get back to the clients through the F5. If your return traffic is not going through the F5 (you will face an asymmetric routing which your Checkpoint FW will drop by anti-spoofing or tcp packet out of state.&nbsp;

k20 · Answer

Is the return "load balanced" traffic not coming back to the F5?&nbsp;
Is the client traffic not hitting your FW1?&nbsp;
What is the default route on your FW2?&nbsp;
Is your FW2 a bridging or layer 3 firewall?&nbsp;
These are unknown variables to me. So any suggestions at this point could be invalid.&nbsp;
Wildcard VS? Are you talking about IP forwarding virtual servers? For example, when your real servers need to go to Microsoft or Linux or whatever vendors to get patched and the traffic has to pass through the F5, yes you would need an outbound IP forwarding virtual server. Same thing for inbound. If you want to get to a particular backend server behind your FW2 from your workstation, for example, in order to do some maintenance, install patches, software, etc., and you don't want to connect to a VS, sure you would also need an inbound IP forwarding virtual server. Just search for "IP forwarding virtual server".&nbsp;

Forum Discussion

F5 Positioning between 2 Firewalls (checkpoint and fortinet)

2 Replies

AppWorld Berlin iRules Contest!

F5 AppWorld 2026 Las Vegas - iRules Contest Winners!

Recent Discussions

Related Content

Integrating SSL Orchestrator with CheckPoint Firewall VM-Explicit Proxy

Integrating SSL Orchestrator with CheckPoint Firewall VM-Bridge Mode (L2)

Integrating SSL Orchestrator with CheckPoint Firewall VM-Transparent Proxy

F5 AFM/Edge Firewall and the difference between Edge Firewalls and Next-generation Firewalls (NGFW)

Bot Defense causing a lot of false positives