topic Re: VPN redundancy with third party devices in Firewall and Security Management

VPN redundancy with third party devices

Sergo89 — Thu, 05 Jan 2023 22:07:58 GMT

Hi Guys,

I have found some ideas how to configure VPN redundancy with third party device (Cisco routers in my case), but some parts are not clear for me. I have one community with about ten devices (Cisco) and hub - checkpoint, everything works fine. I need to create redundancy for couple of sites, they have two ISPs. On Cisco side i am going to create two tunnels and use EMM with SLA or dynamic routing (but not sure about that, in this case i need to configure it on Checkpoint side too).

CheckPoint side, bunch of questions... Looks like i have to create more Interoperable devices and add them to Community, but in this case how CheckPoint will choose them? and how will it know about primary channel outage? etc

Please advise

thanks

Re: VPN redundancy with third party devices

PhoneBoy — Thu, 05 Jan 2023 23:24:47 GMT

Probably the best way to do it with third party devices is with VTIs and Dead Peer Detection.

Re: VPN redundancy with third party devices

Sergo89 — Fri, 06 Jan 2023 00:21:35 GMT

thanks. How it should like from checkpoint side? Another community special for one site with two devices? how to change routing?

Re: VPN redundancy with third party devices

Blason_R — Fri, 06 Jan 2023 02:08:04 GMT

Unfortunately this is a challenge and limitation I faced since beginning and AFAIK this is definitely not possible with checkpoint. Hence I started using different topology or devices like vyos or other routers for VPN IPsec.

Even you configure VTI - VTI is based on Ipsec and you need to have IPsec setup first since CheckPoint listens on only one interface this creates an issue. May be you could try MEP feature

Re: VPN redundancy with third party devices

the_rock — Fri, 06 Jan 2023 04:24:28 GMT

Reality is, @Blason_R is 100% correct. Truth is, making this work with CP is not so easy. MEP sounds like your best bet, because without it, CP will never know how to choose the right 3rd party device in case of failure.

Re: VPN redundancy with third party devices

Sergo89 — Fri, 06 Jan 2023 04:27:52 GMT

Thanks guys!

Re: VPN redundancy with third party devices

the_rock — Fri, 06 Jan 2023 04:29:57 GMT

For the reference:

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SitetoSiteVPN_AdminGuide/Topics-VPNSG/MEP.htm

Andy

Re: VPN redundancy with third party devices

PhoneBoy — Fri, 06 Jan 2023 14:20:59 GMT

It’s a lot more complicated than that since you might need to redo the entire configuration as VTIs instead of using domain based VPN as mixing the two creates its own issue.
MEP might also work as well as others have suggested (but make sure that DPD is configured since that’s required for third party VPN endpoints).