topic VPN link selection use 3main address in Firewall and Security Management

VPN link selection use 3main address

sanoj — Wed, 26 Apr 2023 15:45:41 GMT

Hi,

we have 3ISP topology as external. One ISP link we have configure for vpn site to site.Already running 8 vpn tunnels.

link selection we have manually selected that particular ISP from interface ip link.

we have need to create new vpn with tunnel using another external ISP connection. We are not enabled isp redundancy. If we selected new interface in link selection existing vpns will down.

Can anyone advice what will happen if we select vpn link selection Main Address? Any issues if configured 2ISP with these method?

thank you!

Re: VPN link selection use 3main address

PhoneBoy — Thu, 27 Apr 2023 00:22:34 GMT

Main Address will always use the object IP for the VPN.
If you want the IP to change based on ISP used, ISP Redundancy must be enabled.

Re: VPN link selection use 3main address

the_rock — Thu, 27 Apr 2023 00:53:16 GMT

There is no issue doing it the way you said...Im sure thats how 99% of people do it, BUT, as Phoneboy said, if you want this to change based on ISP itself, then you have to use ISP redundancy. Important note, keep in mind that even IF you use ISPR, thats no guarantee if there is a failover, vpn tunnels will work, as other ends would need to know about the new external IP on CP side, so thats also something to keep in mind.

Re: VPN link selection use 3main address

garrod — Thu, 27 Apr 2023 08:31:17 GMT

Hi PhoneBoy,

I remember got one scenario with some issues, where setup as

<Multiple Router> - <Link Controller/Load Balancer> -Transit Link / Internal IP- <Check Point Gateway>

Where Check Point will only have one Link Selection option for NATed Public IP Address selection, if have multiple Public IP Address, we got any options to include multiple Public IP Address?

Re: VPN link selection use 3main address

PhoneBoy — Thu, 27 Apr 2023 13:33:45 GMT

Unfortunately, you can only specify one IP in Link Selection currently.
This is something I believe we will address in an upcoming release.

Re: VPN link selection use 3main address

the_rock — Thu, 27 Apr 2023 13:55:49 GMT

I think that would be HUGE improvement, if it happens.