topic Re: VPN Redundancy b/w two Gateways in General Topics

VPN Redundancy b/w two Gateways

Saranya_0305 — Sat, 27 Dec 2025 05:19:00 GMT

Dear Mates,

I am exploring VPN labs, where I want to do VPN redundancy configuration.

In detail,

SG1 and SG2 are Checkpoint devices.

I have configured Route based VPN between two SG1 and SG2 using ISP-1 IP address.

I have two ISP(external) interfaces for example ISP-1 and ISP-2 in each gateway and ISP redundancy is configured where VPN traffic is enabled in ISP configuration.

For example ISP-1 is down or no-link status in SG1 but in SG2 both links are UP, I want to connect the VPN between SG1 and SG2 with out interruption.

I have tried to give High Availability in Link selection mode but still Unable to connect.

So, can you please suggest or provide any sk/document for configuration.

Regards,
Saranya

Re: VPN Redundancy b/w two Gateways

Chris_Atkinson — Sat, 27 Dec 2025 10:17:18 GMT

Enhanced Link selection with R82 might be an option for you:

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SitetoSiteVPN_AdminGuide/Content/Topics-VPNSG/Link-Selection-Enhanced.htm?tocpath=Link%20Selection%7C_____1

Re: VPN Redundancy b/w two Gateways

the_rock — Sat, 27 Dec 2025 13:10:01 GMT

Apart from what Chris said, if you use legacy VRPN, you need to make sure proper routes are present in case of link failure.

Re: VPN Redundancy b/w two Gateways

Saranya_0305 — Sun, 28 Dec 2025 07:44:35 GMT

Dear Mates,

I have created Mesh topology successfully in lab.

I have seen in document that VPN Interoperability not supported for Quantum Spark Appliance.

Can I configure VPN redundancy with star topology between a Quantum Enterprise Appliance and a Quantum Spark Appliance, with the Quantum Enterprise acting as the central gateway, when both are managed by the same Management Server?

If Quantum Spark Appliance is not supported for VPN redundancy is there any other way?

Thank you for guidance.

Regards,

Saranya

Re: VPN Redundancy b/w two Gateways

Chris_Atkinson — Sun, 28 Dec 2025 09:47:02 GMT

Yes, more advanced topologies may required SD-WAN.

R82.00.10 may also bring some relevant improvements for Spark.

Re: VPN Redundancy b/w two Gateways

Saranya_0305 — Sun, 28 Dec 2025 11:17:42 GMT

For VPN redundancy in Quantum Spark which are R81.10.XX firmware we need to configure SD-WAN.

For Quantum Enterprise Appliance static/dynamic routing protocol will work.

Is my understanding correct? Please correct if I am mistaken in my understanding.

Regards

Saranya

Re: VPN Redundancy b/w two Gateways

Chris_Atkinson — Sun, 28 Dec 2025 12:45:15 GMT

Not exactly, configuring static / dynamic routing has little to do with the choice of ISP used as the source (peer).

Case in point Spark appliances support route based VPNs (VTI) or MEP just fine to my knowledge.

SD-WAN is just an option, a good one (but requires a license).

Re: VPN Redundancy b/w two Gateways

AmirArama — Sun, 28 Dec 2025 12:21:16 GMT

in order to have SD-WAN overlay between two VPN peers, both sides have to be enabled with Quantum SD-WAN and managed from the same MGMT/MDS.

for no interruption at all, Quantum SD-WAN is the way to go.

you can use either Domain or Route based VPN based on your needs. VPN Redundancy over multiple ISPs will work regardless by the SD-WAN.

Re: VPN Redundancy b/w two Gateways

the_rock — Sun, 28 Dec 2025 13:42:42 GMT

I would agree with that.