Redundant Domain-Based Site2Site IPSEC tunnel

[nickliako]

Hey there.

Is it possible to configure 2 identical Domain based IPSEC VPN tunnels between Checkpoint Appliances,
behaving as Primary & Backup VPN ?
I heard that this can only be accomplished via Route based VPN (vti interfaces) and Static Routes inside Gaia.

Thank you.

[Bob_Zimmerman]

To confirm, you want a tunnel between FW-A and FW-B, then a second tunnel between FW-A and FW-C with the same networks behind FW-B and FW-C?

If not, a diagram may help express what you want to build.

[nickliako]

No, suppose that FW-A has 1 leased link and FW-B has 2 xDSL Internet Links. I want a primary ipsec vpn between FW-A and FW-B via FW-Bs first xDSL Internet Link and and ipsec vpn tunnel between FW-A and FW-B via FW-Bs second xDSL Internet Link.

How am I going to set this scenario up with Policy Based VPNs ?

To confirm, you want a tunnel between FW-A and FW-B, then a second tunnel between FW-A and FW-C with the same networks behind FW-B and FW-C?

If not, a diagram may help express what you want to build.

[mcnallym]

No, suppose that FW-A has 1 leased link and FW-B has 2 xDSL Internet Links. I want a primary ipsec vpn between FW-A and FW-B via FW-Bs first xDSL Internet Link and and ipsec vpn tunnel between FW-A and FW-B via FW-Bs second xDSL Internet Link.

How am I going to set this scenario up with Policy Based VPNs ?

Real Easy

FW-B has two Internet Connections so presumably has ISP Redundancy configured so can use both lines.

Use VPN Link Selection and configure to

Use Probing. Link redundancy mode

Set to High Availability

Then under configure, specify to probe the two External Interfaces, select the First xDSL line IP as the Primary Address and use Using ongoing probing for the probing method.

Install Policy to the two gateways.

FW-A will then use the VPN Probing to test connectivity to the Primary xDSL line IP and if available will use that as the VPN Termination Point at FW-B. If that fails then will attempt to use the Secondary xDSL interface IP.

If separate Manage then define FW-B as Externally Managed Gateway so that can configure the VPN Link Selection still.