topic Re: CP s2s vpn to Azure VPN Gateway (Active-Active) in Firewall and Security Management

CP s2s vpn to Azure VPN Gateway (Active-Active)

H4ppyM3 — Tue, 01 Oct 2024 16:32:55 GMT

Hi ALL,

Did someone build a VPN between on-prem Checkpoint ClusterXL ( act-stb ) and Azure VPN Gateway ( act-act ) ? If so, which type – route or policy based ? As referring https://support.checkpoint.com/results/sk/sk101275 preferred way is policy-based.

If Azure is act-act it will have 2 different public IP’s. How to build the encryption domain if the network behind azure is same for both remote-peers. ( NAT ? )

Re: CP s2s vpn to Azure VPN Gateway (Active-Active)

Alex- — Tue, 01 Oct 2024 16:59:21 GMT

In this setup it is probably preferable to go for two route-based VPN with BGP.

sk176249 discusses this for Azure VWAN and CloudGuard instances, but the Azure VPN Gateway follows mostly the same pattern.

We have successfully configured two redundant VPN gateways to Azure with BGP using this approach.

Re: CP s2s vpn to Azure VPN Gateway (Active-Active)

H4ppyM3 — Tue, 01 Oct 2024 18:22:02 GMT

this sounds like a very good option.

Thank you !!