topic Re: VPN Site to Site with differents ISP in Firewall and Security Management

VPN Site to Site with differents ISP

RLopez — Thu, 02 Nov 2023 17:57:07 GMT

Hello,

I ask here because the documentation is very confusing about thesetopics, maybe you can help me to pick the right option.

A customer has a cluster with a s2s vpn tunnel, it is configured like a domain vpn, using a public ip conected to a ISP1.

Now he needs to add 2 new tunnels, but using 2 new ISP, each one providing his own public ip to be configured in the gateway.

Which type of vpn scenario would be the right one? (still in this community with link selection, new route based vpns, vti.....)

The 3 remote third party gateways are not Check Point devices.

Thanks in advance!

Re: VPN Site to Site with differents ISP

PhoneBoy — Thu, 02 Nov 2023 19:10:17 GMT

The only way this can work right now is for each VPN link to route out a different physical interface with the relevant IP address assigned.
This requires Link Selection to be set up accordingly.
Otherwise, it is not possible to use a different IP for a different VPN peer.
Also, if you're mixing route and domain-based VPNs on the same gateway, see: https://support.checkpoint.com/results/sk/sk109340

Hopefully, with the changes planned for R82, this sort of scenario should be easier to support,.

Re: VPN Site to Site with differents ISP

RLopez — Thu, 02 Nov 2023 21:12:47 GMT

So if I understand it, the way to do this keeping the vpn1 with isp1 as domain vpn is to configure the other 2 as routed vpn, using link selection for this gateway as calculate ip based on network topology and 2 static routes for the two remote networks, each one reachable behing vpn tunnel 2 and vpn tunnel 3, right?

Re: VPN Site to Site with differents ISP

PhoneBoy — Thu, 02 Nov 2023 21:58:01 GMT

That sounds about right, yes.

Re: VPN Site to Site with differents ISP

the_rock — Thu, 02 Nov 2023 23:54:37 GMT

Its right in theory, but in reality, different story... : - (

Re: VPN Site to Site with differents ISP

RLopez — Fri, 03 Nov 2023 06:54:16 GMT

Lol... What do you mean? Did you have problems with this configuration?

Re: VPN Site to Site with differents ISP

the_rock — Fri, 03 Nov 2023 09:00:05 GMT

I dont have problems with it, but its not so easy to make it work, at least from my experience.

Re: VPN Site to Site with differents ISP

MarcosGarcia — Mon, 06 Nov 2023 07:50:31 GMT

Ok, understood. Thanks.

Re: VPN Site to Site with differents ISP

CheckPointerXL — Fri, 17 Nov 2023 21:37:19 GMT

Look my answer and my contributes here https://community.checkpoint.com/t5/Management/Link-selection-into-a-VPN-Community-Settings-R81-20/m-p/127123