topic Re: 2 VPN tunnels with 2 different IP address in Firewall and Security Management

2 VPN tunnels with 2 different IP address

Agust — Wed, 26 Feb 2025 13:57:17 GMT

Hi guys.

We have a question regarding the creation of a second tunnel and the link selection configuration.
We wanted to configure one of the external interfaces of the firewall that has another public IP to set up another VPN tunnel against a site.
We saw the following technical note

sk180613

We currently have all the tunnels based on domain based encryption policies against the IP defined in the firewall by link selection, would this change imply a change or type of outage in the tunnels currently set up against that IP?
We welcome your comments.
Thank you

Re: 2 VPN tunnels with 2 different IP address

PhoneBoy — Wed, 26 Feb 2025 17:30:57 GMT

What is the actual Link Selection configuration currently?
I suspect for this to work, you'll need to do it based on the routing table.

R82 has much better Link Selection settings (can be set per VPN community).

Re: 2 VPN tunnels with 2 different IP address

Agust — Wed, 26 Feb 2025 19:24:16 GMT

Hi Phoneboy!
Currently the link selection in the firewall is configured as follows:
Always use this IP address --> Selected address from topology table --> IP address
The IP address that we currently want to use would be a different public IP than the one that is currently configured in this way. We currently have R81.20 installed on the firewalls that are VS from SGM master.
Thank you for your comments.

Re: 2 VPN tunnels with 2 different IP address

Lesley — Wed, 26 Feb 2025 19:43:29 GMT

I would only perform this type of changes in a small maintenance window.

You might also need to change this:

https://support.checkpoint.com/results/sk/sk160672

During window make sure new VPN tunnel works, but also old tunnels! Consider even to reset them with vpn tu during window to make sure that re-key part is

This type of config is a bit trial / error so better do it in a window

Re: 2 VPN tunnels with 2 different IP address

PhoneBoy — Wed, 26 Feb 2025 20:23:57 GMT

You'd have to change to "Calculate IP Based on Network Topology" and also set the Outgoing Route Selection accordingly.
Like I said, you can set different Link Selection per community in R82.

Re: 2 VPN tunnels with 2 different IP address

the_rock — Thu, 27 Feb 2025 03:05:10 GMT

I will double check this in my lab (R82 one as well), but I believe link selection probing method would also work here.

Andy

Re: 2 VPN tunnels with 2 different IP address

CheckPointerXL — Thu, 27 Feb 2025 21:37:15 GMT

check my lab here

https://community.checkpoint.com/t5/Management/Link-selection-into-a-VPN-Community-Settings-R81-20/m-p/184258#M35266

Re: 2 VPN tunnels with 2 different IP address

Agust — Wed, 12 Mar 2025 15:51:38 GMT

Hello Checkpointer.
Thanks for sharing your lab, it looks very interesting for our purpose.
You used the Calculate IP Based on Network Topology configuration and then the Operating system routing table, using the VPN by policies without problems, correct?
Thank you very much for the info.
Regards

Re: 2 VPN tunnels with 2 different IP address

CheckPointerXL — Wed, 12 Mar 2025 15:55:37 GMT

yes, that's correct

please test on maintnance window