topic Re: S2S VPN redundancy with two ISP in Firewall and Security Management

S2S VPN redundancy with two ISP

Patryk_Pilarski — Wed, 02 Jan 2019 19:05:47 GMT

Hi all,

Could you please point me, if this is possible to configure two active S2S VPN tunnels - one tunnel per one ISP?

My scenario: 5000series (R80.10) appliances configured as a cluster

Eth1 >> connected to ISP 1 (public IP address block /29)

Eth2 >> connected to ISP 2 (public IP address block /29)

I don't use ISP redundancy, because we use PBR for some good reason.

We use S2S tunnels between data center with Juniper SRX and Checkpoint in the office. Inside S2S VPN we use BGP protocol to distribute routes.

I would like to have two active tunnels at the same time - one configured by using ISP1 public IP, second configured by using ISP2. I will distribute better routes for VPN tunnel 1, but in case of problem with ISP1 I expect that VPN tunnel 2 will immediately handover traffic.

I know hot to configure two tunnels in active/standby mode, but I am wondering if this is somehow possible to achieve active/active configuration

Thanks in advance

Re: S2S VPN redundancy with two ISP

PhoneBoy — Wed, 02 Jan 2019 20:12:37 GMT

In Check Point, you do this with a MEP configuration choosing the option "Random Selection."

See: Multiple Entry Point (MEP) VPNs

As the underlying mechanisms are proprietary, I do not believe this will work with a third party VPN endpoint.

Re: S2S VPN redundancy with two ISP

Maarten_Sjouw — Thu, 03 Jan 2019 09:11:07 GMT

You can create tunnel interfaces, on those you can run BGP, in that way you create a redundant setup the same way you use AWS. Route based VPN is what it is called within Check Point.

Re: S2S VPN redundancy with two ISP

CarlosMTZ — Fri, 07 Jun 2024 04:41:30 GMT

Hi Patryk, sorry i know you posted this long time ago but could you please explain how did you setup two tunnels in active/standby mode usign BGP? i already have VTI´s tunnels up but i dont know how to route traffic in a way to have redundancy.

Thanks in advance