topic ISP Redundancy + IPSEC Tunnel with third-party firewall in Firewall and Security Management

ISP Redundancy + IPSEC Tunnel with third-party firewall

Americo_two — Tue, 18 May 2021 19:29:08 GMT

Hi Everyone,

I found some forums about this subject, but I couldn´t find a solution, we have a gateway with R77.30 version installed, and with ISP Redundancy configured, we want to configure an IPSEC VPN with a third-party firewall.

Today this VPN is working with the main link, but we need to add the second link installed to have a contingency in case of failure of one of the links

Re: ISP Redundancy + IPSEC Tunnel with third-party firewall

the_rock — Wed, 19 May 2021 02:43:57 GMT

You have to configure isp redundancy on the firewall itself and then apply that to vpn traffic. Are you familiar how to do that? I cant recall the article, but if you look it up, there are instructions on support site.

Re: ISP Redundancy + IPSEC Tunnel with third-party firewall

Baasanjargal_Ts — Wed, 19 May 2021 02:54:18 GMT

Hello,,

1. You need to enable "Apply settings to VPN traffic" on the ISP redundancy config.

2. Choose "Use Probing. Link redundancy mode" on the IPSEC VPN -> Link selection

look into below guide:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_NextGenSecurityGateway_Guide/Topics-FWG/ISP-Redundancy-and-VPN.htm

Re: ISP Redundancy + IPSEC Tunnel with third-party firewall

PhoneBoy — Wed, 19 May 2021 06:46:21 GMT

While this should work with R77.30 as described in this thread, just know it has been End of Support for at least 18 months and you should strongly consider upgrading to a supported release.

Re: ISP Redundancy + IPSEC Tunnel with third-party firewall

asher — Thu, 26 Aug 2021 14:06:59 GMT

its limited to the following scenario:

1. 2 internet iso lines with isp redundancy

2. another external nic that connect to ipvpn cloud with managed checkpoint branches, in this case the link selection is gray out

and if you enable the isp redundancy what will happend with all the link selection configuration that related to the ipvpn nic for connect branches with ipsec? ( sourc ip , outgoing nic ... )