topic Re: Route-Based VPN (VTI) with Static Route Failover on ClusterXL in General Topics

Route-Based VPN (VTI) with Static Route Failover on ClusterXL

RemoteUser — Tue, 26 May 2026 09:56:29 GMT

Hi Mates,

After configuring two numbered VTIs with static routes and different priorities, when the primary tunnel goes down, traffic does not fail over to the backup tunnel. Any idea please?

Re: Route-Based VPN (VTI) with Static Route Failover on ClusterXL

Chris_Atkinson — Tue, 26 May 2026 11:33:35 GMT

Are you using DPD and how are the return routes configured?

Re: Route-Based VPN (VTI) with Static Route Failover on ClusterXL

RemoteUser — Tue, 26 May 2026 11:43:27 GMT

I'm using permanent tunnel on the community:
set static-route x.x.x.x/24 nexthop gateway address 169.254.x.x priority 1 on
set static-route x.x.x.x/24 nexthop gateway address 169.254.x.x priority 2 on
set static-route x.x.x.x/24 ping on

Re: Route-Based VPN (VTI) with Static Route Failover on ClusterXL

simonemantovani — Tue, 26 May 2026 12:50:16 GMT

When the first tunnel is down, did you check, in bash, with the command ip route get <ip_of_a_remote_host> what route is used to reach the remote host?

Both remote hop (169.254.x.x) are pingable from the gateway?

Re: Route-Based VPN (VTI) with Static Route Failover on ClusterXL

CaseyB — Tue, 26 May 2026 13:06:07 GMT

My configuration looks something like this:

set static-route 10.x.x.x/24 nexthop gateway address 172.20.x.x priority 1 on
set static-route 10.x.x.x/24 nexthop gateway address 172.20.x.x monitored-ip 192.168.x.x on
set static-route 10.x.x.x/24 nexthop gateway address 172.20.x.x monitored-ip-option fail-any
set static-route 10.x.x.x/24 nexthop gateway logical vpnt10 priority 2 on

Make sure you have a monitored IP set for the primary so it knows when to use the backup.

Re: Route-Based VPN (VTI) with Static Route Failover on ClusterXL

simonemantovani — Tue, 26 May 2026 13:38:23 GMT

Based on this sk https://support.checkpoint.com/results/sk/sk156812

The configuration reported by @RemoteUser should be consistent, eventually, It might be worth checking whether pings are allowed.

Re: Route-Based VPN (VTI) with Static Route Failover on ClusterXL

RemoteUser — Tue, 26 May 2026 13:41:14 GMT

I wonder if this is really enough for failover, or if something else is still needed

Re: Route-Based VPN (VTI) with Static Route Failover on ClusterXL

simonemantovani — Tue, 26 May 2026 13:46:03 GMT

As a first step, I would check if ping is ok, if yes, you can proceed with further checks, for example, by checking which route is used when the first vpn is down.

Re: Route-Based VPN (VTI) with Static Route Failover on ClusterXL

RemoteUser — Thu, 28 May 2026 06:35:08 GMT

We solved it by repeating the process (recreating the VTI), and we also tested the failover successfully. Everything is now working as expected based on this SK:
https://support.checkpoint.com/results/sk/sk156812