topic Re: VPN Solution in General Topics

VPN Solution

Renjith_M_P — Wed, 04 Jul 2018 11:38:21 GMT

Hi All,

As shown in the diagram, i have a requirement. Site 1 is connected with Remote Site (marked as permanent tunnel) this is working and up. now i need to configure Redundant Tunnel between Site 2 and Remote Site. as per my understanding MEP will work only with checkpoint. what other solution can be provide here and how do i define priority and route.

Re: VPN Solution

G_W_Albrecht — Wed, 04 Jul 2018 11:45:12 GMT

I just can see a Cisco ASA here - where is which Version/type of CP VPN GW you want a solution for ?

Re: VPN Solution

Renjith_M_P — Wed, 04 Jul 2018 12:05:32 GMT

CP -77.30

ASA-9.x

Re: VPN Solution

Renjith_M_P — Wed, 04 Jul 2018 12:07:12 GMT

checkpoint at both site is managed by same management

Version

CP -77.30

ASA-9.x

Re: VPN Solution

G_W_Albrecht — Wed, 04 Jul 2018 12:19:46 GMT

So both CPs have only one VPN tunnel each, but ASA has one main (permanent) and one redundant VPN tunnel - please correct me if i am wrong. So all redundancy configuration must be done on ASA - maybe a Cisco Forum would be more appropriate for this question .

Re: VPN Solution

Renjith_M_P — Wed, 04 Jul 2018 12:27:23 GMT

No,traffic initiator is CP. there is only one VPN tunnel between Site 1 and Remote ASA site. i need to implement a new backup tunnel from site 2 to Remote ASA. in this setup primary tunnel is Site1 to remote ASA. in case of any failure at site 1, the traffic should pass through Site 2 to Remote ASA.

Re: VPN Solution

G_W_Albrecht — Wed, 04 Jul 2018 12:57:11 GMT

Route Based VPN could be adequate to this scenario, using Numbered VTI. See this discussion:

https://community.checkpoint.com/thread/6641-how-can-i-setup-a-primary-and-backup-s2s-vpn-tunnels

Re: VPN Solution

Timothy_Hall — Thu, 05 Jul 2018 12:26:50 GMT

If heading down the route-based VPN path, R80.10 or later on the gateway is strongly recommended. Prior to R80.10 the utilization of the route-based VPN feature required CoreXL to be disabled (i.e. only one Firewall Worker/kernel instance for all traffic processing).

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

Re: VPN Solution

Houssameddine_1 — Thu, 05 Jul 2018 16:42:24 GMT

if checkpoint gw protecting the same networks and if you don't want to use route based vpn you can try to apply NAT on one of the checkpoint gateways to present different networks for the ASA as encryption domain.