topic Re: MPLS to IPSEC failover in 80.30 with Cisco ASA as remote end device in Firewall and Security Management

MPLS to IPSEC failover in 80.30 with Cisco ASA as remote end device

Ravindra_Yadav — Wed, 14 Aug 2019 12:02:37 GMT

Hi Team,

I have a scenerio where I want to achieve failover between IPSEC vpn and MPLS traffic terminating on the same remote end Cisco ASA device. MPLS will act as primary and when MPLS link fails, traffic should failover to IPSEC vpn.

Is there any way to achieve this between checkpoint & Cisco ASA. Your suggestions would be highly appreciated.

I heard that there is a feature in R80.30 to achieve this.

Regards,

Ravindra

Re: MPLS to IPSEC failover in 80.30 with Cisco ASA as remote end device

Wolfgang — Wed, 14 Aug 2019 12:19:53 GMT

Ravindra,

your solution is found in How To Create a Redundant, Service-based MPLS/Encrypted Link VPN

Wolfgang

Re: MPLS to IPSEC failover in 80.30 with Cisco ASA as remote end device

Ravindra_Yadav — Wed, 14 Aug 2019 12:31:10 GMT

I guess this will work when I have Checkpoint Gateway at both the ends. I have Cisco ASA at the other end.

Re: MPLS to IPSEC failover in 80.30 with Cisco ASA as remote end device

Wolfgang — Wed, 14 Aug 2019 12:40:40 GMT

Ravindra,

Dead Peer Detection is the technology for the remote peer check with third party devices and that's why you need R80.30.

###### snip from R80.30 what's new ############

IPsec VPN

Redundancy for Multiple Entry Points configuration using Dead Peer Detection (DPD) with third party VPN peer

######end snip from R80.30 what's new ##########

Wolfgang