ISP Redundnacy remote access VPN

**gunnahafta** · 2012-11-14

Has anyone had experience with ISP redundnacy and remote acess VPNs? I am doing testing trying to replicate an issue in production. This made me thing of an obvious question im hoping someone can answer. If I am connected to remote access VPN via the Primary ISP in a HA ISP redundnacy connection and the primary ISP fails, do I have to manually reconnect my VPN or "should" it automatically reconenct to the second IP. Also how does the Secureremote client know about the second IP address, i assume its updated in the toopology updates etc but would be great if anyone can point me towards something that documents this.

Thanks.

**mcnallym** · 2012-11-14

Has been some time since I had to do this and I don't believe has changed looking at the SecureClient Feature Support in Endpoint Security VPN R75/E75.x (SecureClient Next Generation), sk56580
,

Link Selection: Multiple interface support with redundancy

Only static Link Selection is supported. This means that if ('Gateway Properties > VPN > Link Selection > "Use a probing method"') is selected, then the setting that will actually apply is (Gateway Properties > VPN > Link Selection > "Always use this IP address" > Main address').

Workaround: None

Comments: Roadmap

As such I believe that you have to cross fingers still that your primary link doesn't fail. I am not sure if you could try a second site definition on the client with the secondary link and see if the Secondary Connect feature would would, however it doesn't seem to be a recognised work around, so not sure if would work.

Other features refer to E75.30 so indicates that the sk is aware of E75.30 remote access client.

The one customer that had the ISP Redundancy and Remote Access no longer uses Check Point for Remote Access.

**gunnahafta** · 2012-11-15

Originally Posted by mcnallym

Has been some time since I had to do this and I don't believe has changed looking at the SecureClient Feature Support in Endpoint Security VPN R75/E75.x (SecureClient Next Generation), sk56580
,

Link Selection: Multiple interface support with redundancy

Only static Link Selection is supported. This means that if ('Gateway Properties > VPN > Link Selection > "Use a probing method"') is selected, then the setting that will actually apply is (Gateway Properties > VPN > Link Selection > "Always use this IP address" > Main address').

Workaround: None

Comments: Roadmap

As such I believe that you have to cross fingers still that your primary link doesn't fail. I am not sure if you could try a second site definition on the client with the secondary link and see if the Secondary Connect feature would would, however it doesn't seem to be a recognised work around, so not sure if would work.

Other features refer to E75.30 so indicates that the sk is aware of E75.30 remote access client.

The one customer that had the ISP Redundancy and Remote Access no longer uses Check Point for Remote Access.

Thanks, i assuem this probably goes for R65 Secureclient aswell then.

**mcnallym** · 2012-11-15

Never tried it with the R60 SecureClient series as out of support by the time I was implementing the gateways The document however is only related to E75 series of software, I believe that the older R60 series actually did work however. When you say R65 SecureClient I presume that you mean the R60 HFA3 client.