topic Re: Backup vpn tunnel to Azure when Express route is Primary in Firewall and Security Management

Backup vpn tunnel to Azure when Express route is Primary

ajsingh — Mon, 13 Nov 2023 02:36:28 GMT

Hi all,

I am attempting to establish a backup VPN link from on-premises to our Azure tenant. Currently, I have Check Point (CP) FW version r81.10 configured as follows: CP FW ----> MPLS ----> Express Route ----> Azure.

I would like to set up a VPN from the CP firewall to Azure (with BGP, I presume) to achieve redundancy.

Is it possible with Check Point firewalls? If yes, should I be using BGP? Could I receive some guidance or steps from someone who has already done this or has knowledge on this matter, please?

Any help is greatly appreciated.

Re: Backup vpn tunnel to Azure when Express route is Primary

the_rock — Mon, 13 Nov 2023 02:51:19 GMT

My colleague and I actually have same scenario with the customer and MS support sent them something that we are trying to verify would work in their case. Will keep you posted on what we find.

I am fairly sure it is possible and yes, you need BGP, for sure. It really boils down to these things:

-xpress route is ALWAYS preferred

-VPN will be preferred IF prefix is shorter, so say /17 over /16 subnet

Andy

Re: Backup vpn tunnel to Azure when Express route is Primary

ajsingh — Tue, 14 Nov 2023 14:18:02 GMT

Thank you. I will wait 🙂

Re: Backup vpn tunnel to Azure when Express route is Primary

the_rock — Tue, 14 Nov 2023 14:50:03 GMT

Customer included us on the email thread with Azure support, so lets see what they say 🙂

Re: Backup vpn tunnel to Azure when Express route is Primary

Messalina — Mon, 28 Oct 2024 07:24:56 GMT

Hello fellows, old thread but this is exactly what I am trying to deploy now. If you have any links to share it would be helpful. SK articles, documentation, experience and so on.

Re: Backup vpn tunnel to Azure when Express route is Primary

_Val_ — Mon, 28 Oct 2024 07:52:47 GMT

@Messalina I would suggest opening a new thread about that.

Re: Backup vpn tunnel to Azure when Express route is Primary

the_rock — Mon, 28 Oct 2024 10:18:51 GMT

I do, but sadly cant share them, as my colleague and I specifically made them for the customer, sorry.

Andy

Re: Backup vpn tunnel to Azure when Express route is Primary

Messalina — Mon, 28 Oct 2024 10:30:38 GMT

Okey thanks for letting me know anyway. Sounds like you have found a working solution.

Re: Backup vpn tunnel to Azure when Express route is Primary

the_rock — Mon, 28 Oct 2024 13:04:02 GMT

We did, but then client decided to go with Harmony SASE, which is way better anyway.

Andy