> Source: [sk39960](https://support.checkpoint.com/results/sk/sk39960) # sk39960 - How to allow Dynamic Routing protocols traffic (OSPF, BGP, PIM, RIP, IGRP) through Check Point Security Gateway | Property | Value | |----------|-------| | Solution ID | sk39960 | | Date Created | 2009-04-14 | | Last Modified | 2023-07-11 | | Technical Level | General | | OS | Gaia | ## Solution This article provides a general action plan for allowing the Dynamic Protocols traffic to pass through Security Gateway. For more details about Dynamic Routing protocols, refer to these Advanced Routing Administration Guides and to the relevant documents (RFC) available on the Internet: * [R80.30 Gaia Advanced Routing Administration Guide](https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_Gaia_Advanced_Routing_AdminGuide/html_frameset.htm) * [R80.40 Gaia Advanced Routing Administration Guide](https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_Gaia_Advanced_Routing_AdminGuide/Default.htm) * [R81 Gaia Advanced Routing Administration Guide](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_Advanced_Routing_AdminGuide/Topics-GARG/Gaia-Advanced-Routing.htm?tocpath=Introduction%20to%20Gaia%20Advanced%20Routing "R81 Gaia Advanced Routing Administration Guide") * [R81.10 Advanced Routing Administration Guide](https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Gaia_Advanced_Routing_AdminGuide/Default.htm) After performing the necessary configuration steps in SmartConsole, install the policy on the Security Gateways. **List of protocols:** 1. Allowing OSPF 2. Allowing BGP 3. Allowing PIM 4. Allowing RIP (v1, v2) 5. Allowing IGRP ### (1) Allowing OSPF {#Allowing OSPF} **Related Solutions:** * [sk36969 - How to configure OSPF on Security Gateway \& UTM-1 Edge VTI environment](http://supportcontent.checkpoint.com/solutions?id=sk36969) * [sk41393 - How to Troubleshoot OSPF Problems](http://supportcontent.checkpoint.com/solutions?id=sk41393) * [sk84520 - How to debug OSPF and RouteD daemon on Gaia](http://supportcontent.checkpoint.com/solutions?id=sk84520) An OSPF rule looks like this - the Destination address is always the OSPF routers themselves, as well as the multicast addresses of 224.0.0.5 (*All OSPF Routers* ) and 224.0.0.6 (*All Designated Routers* ). 1. Create a Host object that represents 224.0.0.1 (*All OSPF Hosts* ) and call it, for example '`ALLSYSTEMS.MCAST.NET`'. 2. Create a Host object that represents 224.0.0.5 (*All OSPF Routers* ) and call it, for example '`OSPF-ALL.MCAST.NET`'. 3. Create a Host object that represents 224.0.0.6 (*All Designated Routers* ) and call it, for example '`OSPF-DSIG.MCAST.NET`'. |-----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|---------------|------------|----------------------------| | **Source** | **Destination** | **Service** | **Action** | **Install On** | | OSPF Routers Relevant Security Gateways | '`ALLSYSTEMS.MCAST.NET`' (224.0.0.1) '`OSPF-ALL.MCAST.NET`' (224.0.0.5) '`OSPF-DSIG.MCAST.NET`' (224.0.0.6) OSPF Routers Relevant Security Gateways | `ospf` `igmp` | `Accept` | Relevant Security Gateways | ### (2) Allowing BGP {#Allowing BGP} **Related Solution:** [sk40689 - How to enable TCP MD5 Authentication for BGP Routing](http://supportcontent.checkpoint.com/solutions?id=sk40689) BGP runs over TCP port 179. One TCP connection is opened for each BGP peer. Each peer must be allowed to send BGP messages over its connection to the Security Gateway. Make a group of the GP peers and allow the group with the following rule: |--------------------------------------|--------------------------------------|-------------|------------|----------------------------| | **Source** | **Destination** | **Service** | **Action** | **Install On** | | BGP Peers Relevant Security Gateways | BGP Peers Relevant Security Gateways | `bgp` | `Accept` | Relevant Security Gateways | ### (3) Allowing PIM {#Allowing PIM} **Related Solutions:** * [sk40632 - Multicast Routing Protocol FAQ](http://supportcontent.checkpoint.com/solutions?id=sk40632) * [sk32702 - Configuring PIM and IGMP Multicast Protocols](http://supportcontent.checkpoint.com/solutions?id=sk32702) * [sk38824 - Staging a very simple IP Multicast (PIM-SSM) lab](http://supportcontent.checkpoint.com/solutions?id=sk38824) * [sk62020 - How to configure Protocol Independent Multicast - Sparse-Mode (PIM-SM) on VSX](http://supportcontent.checkpoint.com/solutions?id=sk62020)[](http://supportcontent.checkpoint.com/solutions?id=sk55100) To allow Sparse Mode PIM Traffic or Dense Mode PIM Traffic: 1. Create a Host object that represents 224.0.0.13 (*PIM v2* ) and call it, for example '`PIM.MCAST.NET`'. 2. Create a custom service in SmartDashboard ? tab '`Services`' ? '`?? Other`' ? right mouse click ? '`New Other...`': * Under '`Name:`' type, for example '`PIM_service`' * Under '`IP Protocol:`' type `103` (Note: this is the number assigned to PIM protocol) Then create the following rule at the very top of the rulebase: |------------------------------------------|--------------------------------|----------------------|------------|----------------------------| | **Source** | **Destination** | **Service** | **Action** | **Install On** | | Relevant Security Gateways PIM neighbors | '`PIM.MCAST.NET`' (224.0.0.13) | `PIM_service` `igmp` | `Accept` | Relevant Security Gateways | ### (4) Allowing RIP (v1, v2) {#Enabling RIP} #### (4-A) RIP version 1 RIPv1 runs over UDP port 520. It sends and receives all messages on this port. All messages are sent to the local broadcast address. To enable RIPv1, add a rule to allow all the neighbors of the Security Gateway to send messages to UDP port 520 on the local broadcast network. |------------|-----------------------------|-------------|------------|----------------------------| | **Source** | **Destination** | **Service** | **Action** | **Install On** | | Neighbor_1 | Network_1_Broadcast_Address | `rip` | `Accept` | Relevant Security Gateways | | Neighbor_2 | Network_2_Broadcast_Address | `rip` | `Accept` | Relevant Security Gateways | | Neighbor_3 | Network_3_Broadcast_Address | `rip` | `Accept` | Relevant Security Gateways | #### (4-B) RIP version 2 RIPv2 can use either the RIPv1 broadcast transport mechanism, or a multicast transport - 224.0.0.9 (`RIP v2`). To enable RIPv2 in multicast mode, create a Host object that represents 224.0.0.9 and call it, for example '`RIP2-ROUTERS.MCAST.NET`'. |------------|----------------------------------------|-------------|------------|----------------------------| | **Source** | **Destination** | **Service** | **Action** | **Install On** | | Neighbors | '`RIP2-ROUTERS.MCAST.NET`' (224.0.0.9) | `rip` | `Accept` | Relevant Security Gateways | ### (5) Allowing IGRP {#Allowing IGRP} IGRP runs on top of IP. IGRP has protocol number 9 assigned to it. Define a group of neighbor routers that participate in IGRP routing, and allow the IGRP traffic on the relevant Security Gateways: |------------|----------------------------|-------------|------------|----------------------------| | **Source** | **Destination** | **Service** | **Action** | **Install On** | | Neighbors | Relevant Security Gateways | `igrp` | `Accept` | Relevant Security Gateways | --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content