topic Re: VPN S2S 2 ISPs + AWS in Firewall and Security Management

VPN S2S 2 ISPs + AWS

IMCristian_Rosa — Thu, 05 Oct 2023 18:38:15 GMT

Hello,

We have a cluster on R81.10, in which we have two links/ISP from different suppliers. We would like to enable redundancy for a VPN with AWS.
EX:
ISP 1
ISP2

In other words, having 2 active tunnels, when the ISP1 tunnel fails, the ISP2 tunnel is activated.

As we know that S2S VPNs with AWS are route based, we have already ruled out using link selection.

In a first conversation with AWS, they informed us that it will have to be done via BGP.

Has anyone already implemented this configuration?

Re: VPN S2S 2 ISPs + AWS

the_rock — Sun, 08 Oct 2023 21:57:48 GMT

Why not use MEP? It applies if you have more than 1 center gateway, unless you are strictly referring to ISP redundancy?

Andy

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SitetoSiteVPN_AdminGuide/Topics-VPNSG/MEP.htm

Re: VPN S2S 2 ISPs + AWS

IMCristian_Rosa — Mon, 09 Oct 2023 00:51:12 GMT

Hello, The_Rock,

Tks for feedback.

What I need is ISP redundancy to have redundancy between two tunnels.

Tks

Cristian Rosa

Re: VPN S2S 2 ISPs + AWS

the_rock — Mon, 09 Oct 2023 01:44:58 GMT

Hey mate,

Not so sure thats possible, because if you think about it logically, how would the AWS side ever know that there was ISP like change and would be aware of new external IP?

Andy

Re: VPN S2S 2 ISPs + AWS

PhoneBoy — Mon, 09 Oct 2023 19:47:56 GMT

Have you tried this? https://support.checkpoint.com/results/sk/sk108958

Re: VPN S2S 2 ISPs + AWS

IMCristian_Rosa — Tue, 10 Oct 2023 19:08:05 GMT

Andy,

This scenario is common, how would I do VPN redundancy using VTI/AWS?

Is there no possibility?

Tks

Cristian Rosa

Re: VPN S2S 2 ISPs + AWS

IMCristian_Rosa — Tue, 10 Oct 2023 19:08:38 GMT

Hello, PhoneBoy

Tks for feedback.

What I need is ISP redundancy to have redundancy between two tunnels.

Re: VPN S2S 2 ISPs + AWS

PhoneBoy — Tue, 10 Oct 2023 20:16:38 GMT

From sk108958: "To detect when a tunnel goes down and to route traffic through the second tunnel, we use BGP."

Re: VPN S2S 2 ISPs + AWS

IMCristian_Rosa — Tue, 10 Oct 2023 20:25:11 GMT

Hi,

But in this case, the reference is to the second tunnel on the AWS side. In AWS there will be redundancy, but on the Checkpoint side.

Note that there is only one peer/ISP on the Checkpoint side.

Tks

Cristian Rosa

Re: VPN S2S 2 ISPs + AWS

the_rock — Tue, 10 Oct 2023 20:55:42 GMT

We had a client who wanted similar thing and we did end up using BGP, though this was Azure, but literally the same concept.