topic One VTI two(2) ISP and 3rd party remote peer with one(1) ISP in Firewall and Security Management

One VTI two(2) ISP and 3rd party remote peer with one(1) ISP

le0costa — Tue, 29 Aug 2023 15:20:55 GMT

Currently in 81.10, we have a SG Cluster with 2 nodes (Active passive mode).

We also have 2 ISPs (ISP A with 10Mb and ISP B with 5 Mb bandwidth) in our location and would like to configure a VPN with a 3rd party Interoperable Device. The peer side has only one ISP and we need redundancy on this configuration. Also, on top of redundacy, and active active configuration to gain throughput.

With static routing, we need help to identify a way to enable the firewall to see only one VTI having two s2s tunnels underneath it. We see this concept on other vendors, but we have some difficulty finding out documentation that allows this kind of scenario.

Can you help identify the correct setup or configuration for this scenarion?

Thanks guys.

Re: One VTI two(2) ISP and 3rd party remote peer with one(1) ISP

the_rock — Tue, 29 Aug 2023 15:37:41 GMT

Keep in mind, with ISPR on CP, if one link fails, other side will NEVER know about the new external IP address, unless its manually changed in the vpn link selection.

Andy

Re: One VTI two(2) ISP and 3rd party remote peer with one(1) ISP

le0costa — Tue, 29 Aug 2023 21:16:31 GMT

On the other firewall we have the VPN setup with the TWO ISPs behind a virtual tunnel interface.

There is in fact a doubt on how to configure it correctly on the CP to work transparently.