topic Redundancy VPN S2S in Firewall and Security Management

Redundancy VPN S2S

Icaro_IT — Wed, 06 Dec 2023 14:19:12 GMT

Good morning

I would like a suggestion on how to perform site-to-site VPN redundancy between a checkpoint and fortigate. Both sides have two ISP links, and both must communicate cross-formation in case of failure of the main ISP

Example image attached

Re: Redundancy VPN S2S

starmen2000 — Wed, 06 Dec 2023 15:50:20 GMT

I am interested in this topic too.

Re: Redundancy VPN S2S

the_rock — Wed, 06 Dec 2023 15:53:07 GMT

I will ask one of my colleagues about Fortigate part, but I can tell you this about CP part. Even if you have ISP redundancy enabled, primary isp link failure will NOT automatically guarantee that VPN tunnel will simply continue to work, as Fortigate would never be aware of new IP address.

Andy

Re: Redundancy VPN S2S

Icaro_IT — Wed, 06 Dec 2023 16:00:23 GMT

both sides know the IP of both ISP

Re: Redundancy VPN S2S

the_rock — Wed, 06 Dec 2023 16:02:27 GMT

If both ends know about the IPs of both links, then I dont see why it would not work, since in that case, if there is ever a failure, 2nd link would be able to establish a tunnel.

Andy

Re: Redundancy VPN S2S

Icaro_IT — Wed, 06 Dec 2023 16:11:03 GMT

right, but what is the best way to do this at the checkpoint? based on static route, mode redundancy probe (CP feature), BGP... or just add a start community with two satellites referencing the fortigate side

Re: Redundancy VPN S2S

the_rock — Wed, 06 Dec 2023 16:15:41 GMT

There way smarter people than I on this forum, so Im sure they will chime in, but logically, I would say 2 satellites for FGT end. Not sure BGP would really make much difference here, as you are not doing say xpress route/VPN failover with Azure (just an example)

Andy

Re: Redundancy VPN S2S

CheckPointerXL — Sat, 09 Dec 2023 14:29:41 GMT

Route based with static route+priority+ping reachability or bgp+ smaller/bigger announcement (for example announce 192.168.0.0/24 for backup link and announce 192.168.0.0/25 and 192.168.0.128/25 for primary link). Other tips for bgp could be MED or AS-PATH-Prepend.

You can configure two communities or one with two FGT satellites.

Make sure ISP redundancy is applied for vpn too