topic Re: ISP Redundancy and VPN site-to-site in Firewall and Security Management

ISP Redundancy and VPN site-to-site

paulocosta — Tue, 05 Mar 2024 20:19:35 GMT

Hi,

I need your help. I have this scenarious:

Site1: Managment server with cluster( 2x gateways, and 2 ISP ( A.A.A.A + B.B.B.B)

Site2: Managment server with cluster( 2x gateways, and 2 ISP ( C.C.C.C + D.D.D.D)

My questions is: When i make site-to-site VPN with site 1 and 2, i need garanted redundancy of ISP. What is a best pratices for this scenarious?

Thanks

Re: ISP Redundancy and VPN site-to-site

_Val_ — Tue, 05 Mar 2024 22:14:29 GMT

Please read the documentation, I believe it covers what you need. If not, let me know.

Re: ISP Redundancy and VPN site-to-site

the_rock — Wed, 06 Mar 2024 00:12:58 GMT

See...key here is that even with ISPR configured, other side needs to be aware of say site's 1 both links (same the other way around) and since its NOT supported to have same interoperable object, or in your case externally managed gateways (as its CP) in the same community, personally, I would approach TAC with an official answer as far as best approach.

Maybe simple network diagram may also help us,

Best,

Andy

Re: ISP Redundancy and VPN site-to-site

paulocosta — Wed, 06 Mar 2024 09:16:56 GMT

Hi _Val_

Thanks for your reply.

Yes, already read this documentation. Maybe my first post not is a very complete.

When i create a site-to-site vpn i need create interoperable device (one for a ISP) and put it all in VPN Communitie, because i have two managments servers

Thanks

Re: ISP Redundancy and VPN site-to-site

the_rock — Wed, 06 Mar 2024 12:09:16 GMT

Keep in mind, its NOT supported to use same interoperable object in more than 1 vpn community. As a a matter of fact, if you do that, policy install will fail, 100%. The only way it would work is if you clone existing int. object, give it another name, but then there is no way to differ which community will take presedence and probably only 1 tunnel may show as up, you would not even see the other ones.

Best,

Andy

Re: ISP Redundancy and VPN site-to-site

_Val_ — Wed, 06 Mar 2024 17:27:06 GMT

Why Interoperable? Do Externally Managed GWs. What's the issue, then?

Re: ISP Redundancy and VPN site-to-site

paulocosta — Wed, 06 Mar 2024 17:53:13 GMT

Hi,

This is scenarios:

I need to create a site-to-site VPN to connect sites 1 and 2. One requirement is: if ISP A.A.A.A has a problem, I need ISP B.B.B.B to maintain a VPN connection.

My question is: When I create a VPN community for connecting site 1 to site 2, as this site has a different management server, how can I tell the Sattelite Gateways that I have 2 possible ISP connections? I need to create 2 written interoperable devices right?

How do you suggest?