topic Re: IPSEC VPN gateway traffic selection in Firewall and Security Management

IPSEC VPN gateway traffic selection

Dilev — Tue, 24 Nov 2020 08:42:38 GMT

Hi,

We are having an issue with a vpn setup where we have a Checkpoint FW with one ISP line connected to it and a remote site (Juniper srx) with 2 ISP lines connected to it. We have 2 Ikev1 IPSEC vpn tunnels between the two sites that coming up(permanent tunnels enabled).
Our issue is that the traffic between the two sites seems to be going through both tunnels at the same time instead of one tunnel being the primary one and the second one acting as a backup/failover in case the primary tunnel goes down for any reason.

What is the mechanism Checkpoint uses to determine which of the two tunnels it is going to send the traffic through and how can we specify it?

Re: IPSEC VPN gateway traffic selection

_Val_ — Tue, 24 Nov 2020 10:46:50 GMT

Version fo CP GW?

Re: IPSEC VPN gateway traffic selection

Dilev — Tue, 24 Nov 2020 10:48:31 GMT

Hi Val,

The CP GW version is R80.10.

Re: IPSEC VPN gateway traffic selection

_Val_ — Tue, 24 Nov 2020 11:03:54 GMT

https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_SitetoSiteVPN_AdminGuide/html_frameset.htm?topic=documents/R80.10/WebAdminGuides/EN/CP_R80.10_SitetoSiteVPN_AdminGuide/13924

Look under "Link Selection with non-Check Point Devices" section.

Which part initiates VPN tunnel, Juniper or CP? If Juniper, you should look there first.

Re: IPSEC VPN gateway traffic selection

Dilev — Thu, 10 Dec 2020 10:44:32 GMT

Hi,

We've tried the things suggested in the article, but we are still having issues with the traffic selection.

Currently, the traffic from the checkpoint is taking the backup tunnel to our SRX, instead of the primary one. How can we force it to use one tunnel over the other and switch to the second only if the traffic through the first one fails?

Re: IPSEC VPN gateway traffic selection

Juan_ — Thu, 10 Dec 2020 11:49:30 GMT

I suggest using VTIs with a routing protcol over it.

What is known as "Route based VPN"

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk31012&partition=Basic&product=IPSec

Check IPsec VPN admin guide for your version.

Also you can check config guides for AWS or azure as reference.