topic Re: High availability for VPN connections to two external gateways in Firewall and Security Management

High availability for VPN connections to two external gateways

Sandgirl — Thu, 16 Nov 2023 12:19:14 GMT

Hi,

We have a VPN established between our Checkpoint cluster and a remote gateway.

The owner of the remote gateway has asked if we could create an additional VPN tunnel to a secondary remote gateway, to set up high availability: VPN traffic only flows to the primary (original) remote gateway, unless the gateway becomes unreachable. If this happens, the traffic is to be flowing to a secondary (new) gateway.

Is this possible to achieve? And if yes, how?

Sandgirl

Re: High availability for VPN connections to two external gateways

PhoneBoy — Thu, 16 Nov 2023 18:59:23 GMT

You need to configure MEP (Multiple Entry Point) or a Route-Based VPN.
For MEP: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SitetoSiteVPN_AdminGuide/Topics-VPNSG/MEP.htm

Re: High availability for VPN connections to two external gateways

the_rock — Thu, 16 Nov 2023 19:12:56 GMT

As Phoneboy said, you need MEP, but it would be same vpn community.

Andy

Re: High availability for VPN connections to two external gateways

Sandgirl — Fri, 17 Nov 2023 11:48:29 GMT

Hi,

I'm not sure I was clear in my previous post.
If I understand it correctly, MEP would be setting up redundancy on our end, so the remote gateway connects to either (our) primary gateway or (our) secondary gateway.

What we need is a redundant connectivity from our cluster to two remote security gateways.

If the tunnel between our cluster and the primary remote gateway fails, then the traffic flows from our cluster to the secondary remote gateway (via the backup VPN tunnel).

Regards,

Sandgirl

Re: High availability for VPN connections to two external gateways

the_rock — Fri, 17 Nov 2023 14:06:06 GMT

You are right about MEP @Sandgirl . If you want to achieve 2nd scenario, sounds like you may need some BGP config done, because if one VPN was to fail, unless routes match 100%, other one would never take over.

My colleague and I actually have call today with Azure support for similar question one of our customers had, as there are few things to consider. In this case, its related to xpress route, so say if prefix is the same, then xpress route is always preferred over VPN, but if say you have /24 over /23 prefix, bigger number prefix will always take presedence.

As fas as 2 VPN tunnels, your case might be a bit different though...

Andy

Re: High availability for VPN connections to two external gateways

Wolfgang — Mon, 20 Nov 2023 16:47:34 GMT

@Sandgirl like @PhoneBoy said, MEP is your solution. MEP is supported with third party gateways at the remote site. The main difference to Check Points own RDP probing, you‘re remote gateways should support DeadPeerDetection DPD. Your gateway/cluster probes the remote gateways and if the primary is available this link will be used for your VPN. If primary is dead and the backup gateway answer via DPD the second link will be used for the VPN tunnel.

Configuration of MEP with third party will be tricky and needs a lot of knowledge at both sites. Have a look at the link mentioned by @PhoneBoy and following knowledgebase article VPN redundancy does not work when establishing an IPsec VPN Tunnel with a third-party peer

An example for vpn redundancy with zscaler can be seen here How to set up VPN between a Check Point Security Gateway and Zscaler ZIA Public Service Edge

Re: High availability for VPN connections to two external gateways

CheckPointerXL — Fri, 17 Nov 2023 20:49:00 GMT

If i understand correctly, MEP is not relevant here

You need route based with dynamic routing or static routing+probing next hop

Re: High availability for VPN connections to two external gateways

Sandgirl — Mon, 20 Nov 2023 10:23:28 GMT

What if I have two external gateways added in the same community? Will Checkpoint be sending the traffic to both gateways at the same time? And if one of the tunnels fail, the traffic will still go through the secondary tunnel?

Regards,
Joanna

Re: High availability for VPN connections to two external gateways

the_rock — Mon, 20 Nov 2023 11:11:13 GMT

You mean if you have 1 community with 1 CP center gateway and 2 interoperable objects (external) as satellites? If so, I had never seen such scenario work in a failover.

Regards,

Andy

Re: High availability for VPN connections to two external gateways

Sandgirl — Mon, 20 Nov 2023 11:25:13 GMT

How would the traffic flow if there was nothing wrong? Would the traffic flow to both gateways (through two tunnels)? Or would only one tunnel be used?

Regards,

Sandgirl

Re: High availability for VPN connections to two external gateways

the_rock — Mon, 20 Nov 2023 11:55:04 GMT

Im thinking both, but not 100% sure, maybe someone else can confirm.

Andy

Re: High availability for VPN connections to two external gateways

RalphLopez — Mon, 20 Nov 2023 16:35:39 GMT

I had the same situation as @Sandgirl... Peer has two PaloAlto appliances with two different ISP links and IP addresses, and wants to setup redundant link to my Cluster with only one VIP and internet connection. I had no idea I could set third party gateways to be the center in MEP setup and I'm just the remote.

Will give this a try if they are good with the configuration on the other side.

Thanks so much!

Re: High availability for VPN connections to two external gateways

the_rock — Mon, 20 Nov 2023 16:38:31 GMT

You can do that, BUT, I still dont believe failover would work that way either.

Andy

Re: High availability for VPN connections to two external gateways

Wolfgang — Mon, 20 Nov 2023 16:52:09 GMT

@Sandgirl follow my post and the mentioned knowledgebase article. You‘re needed configuration is shown there.

Re: High availability for VPN connections to two external gateways

Wolfgang — Mon, 20 Nov 2023 16:54:41 GMT

@RalphLopez follow my post. The solution for a redundant VPN with third party gateways could be found in the mentioned article.

Re: High availability for VPN connections to two external gateways

the_rock — Mon, 20 Nov 2023 17:28:12 GMT

Its all great in theory, but it does not really work. Not sure if anyone made it work, but I was with customer once on the phone for 7 hours trying to do so and after talking to many T3s, escalation people, seems like they gave up on it and we just left it alone.

Andy

Re: High availability for VPN connections to two external gateways

Cristian_F_CCSM — Thu, 30 Nov 2023 11:13:21 GMT

Yes, I confirm, MEP isn't the best solution about the original request.

The solution is to have two interoperable VPN device, two VPNT and eBGP.

Regards.

Re: High availability for VPN connections to two external gateways

G_W_Albrecht — Thu, 30 Nov 2023 11:48:04 GMT

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_SitetoSiteVPN_AdminGuide/Topics-VPNSG/Link-Selection.htm

https://support.checkpoint.com/results/sk/sk76281

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_ClusterXL_AdminGuide/Topics-CXLG/ISP-Redundancy-and-VPN.htm

Re: High availability for VPN connections to two external gateways

Sandgirl — Thu, 07 Dec 2023 11:56:18 GMT

At the moment our gateways have only one external IP, which is a cluster IP. It's the remote peer that has two reachable IPs.

The third party now says that we need to set up VTIs on our end, but will this work since we have a cluster rather than the single gateway?

Regards,
Sandgirl

Re: High availability for VPN connections to two external gateways

Sandgirl — Mon, 11 Dec 2023 11:02:48 GMT