topic Re: ClusterXL - VxLAN over redundant IPSec VPN (R81.10 and future release) in Firewall and Security Management

ClusterXL - VxLAN over redundant IPSec VPN (R81.10 and future release)

hdas — Fri, 18 Jun 2021 11:19:17 GMT

Hello Mates,

does someone know if the R81.10 will support redundant IPSec VPN and VxLAN over IPSec?

As far as I know, the R80.40 and R81 do not support multiple link selection for the multiple VPN tunnels (different public subnets).

This is what I want to achieve:

Thanks,

Re: ClusterXL - VxLAN over redundant IPSec VPN (R81.10 and future release)

Benedikt_Weissl — Fri, 18 Jun 2021 14:10:08 GMT

You could try VPN Link Selection in Load Sharing mode. According to the FAQ here (https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk56384&partition=Basic&product=IPSec#Topology) it will only create one VPN Tunnel and balance the packets between the different links.

Re: ClusterXL - VxLAN over redundant IPSec VPN (R81.10 and future release)

PhoneBoy — Fri, 18 Jun 2021 20:08:13 GMT

Pretty sure this is not among the features supported, see: https://community.checkpoint.com/t5/Product-Announcements/R81-10-EA-Program-Production/ba-p/110053

Mostly likely this exact configuration is an RFE and I encourage you to bring it through your local Check Point office.

Re: ClusterXL - VxLAN over redundant IPSec VPN (R81.10 and future release)

genisis__ — Sun, 20 Jun 2021 10:12:46 GMT

not sure about this, but could you not just run x2 GRE tunnels through the Checkpoints?

Re: ClusterXL - VxLAN over redundant IPSec VPN (R81.10 and future release)

hdas — Mon, 21 Jun 2021 09:36:07 GMT

My goal was to find a way to use both internet connections at the same time.

Re: ClusterXL - VxLAN over redundant IPSec VPN (R81.10 and future release)

hdas — Mon, 21 Jun 2021 09:46:32 GMT

Hi PhoneBoy,

I don't know if the local office will be able to support me on this. We need to look elsewhere, disaggregation maybe? Just think how useful would be to have the control plane (VRF, virtual router..etc) in ClusterXL? 😍

Re: ClusterXL - VxLAN over redundant IPSec VPN (R81.10 and future release)

Benedikt_Weissl — Mon, 21 Jun 2021 11:04:37 GMT

You can use ISP Redundancy for LAN to WAN Traffic und VPN Load Sharing (https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_SitetoSiteVPN_AdminGuide/html_frameset.htm?topic=documents/R80.30/WebAdminGuides/EN/CP_R80.30_SitetoSiteVPN_AdminGuide/136968) for Site2Site VPN Traffic