https://community.checkpoint.com/t5/General-Topics/VPN-to-third-party-in-an-ISP-HA-configuration-with-probing/m-p/49699#M9752 <P>OK so this is a question regarding the Identity the checkpoint sends in packet 5 of the phase 1 communication when establishing a VPN. Specifically when the firewall has ISP redundancy configured in probing mode and you want to establish a backup VPN to a third party vendor</P><P>According to&nbsp;<SPAN>sk57441 this IP address used as identity in packet 5 is defined using the configuration under&nbsp;IPSec VPN -&gt; Link selection. Now the situation I have is the customer has a large VPN mesh configured and naturally&nbsp;has probing enabled to support the ISP redundancy. The also have a VPN to the third party to support there services. The problem is that when probing&nbsp;option is enabled for link selection it always uses the primary&nbsp;interface IP address as the ID in packet 5. In the mesh where all gateways are managed by the central manager this is not a problem but third party devices do not support this.&nbsp;</SPAN></P><P><SPAN>Has any one come across&nbsp;this situation before and have a solution or is this a by design feature?</SPAN></P> Wed, 03 Apr 2019 10:55:33 GMT Nigel_Dennison 2019-04-03T10:55:33Z https://community.checkpoint.com/t5/General-Topics/VPN-to-third-party-in-an-ISP-HA-configuration-with-probing/m-p/49699#M9752 <P>OK so this is a question regarding the Identity the checkpoint sends in packet 5 of the phase 1 communication when establishing a VPN. Specifically when the firewall has ISP redundancy configured in probing mode and you want to establish a backup VPN to a third party vendor</P><P>According to&nbsp;<SPAN>sk57441 this IP address used as identity in packet 5 is defined using the configuration under&nbsp;IPSec VPN -&gt; Link selection. Now the situation I have is the customer has a large VPN mesh configured and naturally&nbsp;has probing enabled to support the ISP redundancy. The also have a VPN to the third party to support there services. The problem is that when probing&nbsp;option is enabled for link selection it always uses the primary&nbsp;interface IP address as the ID in packet 5. In the mesh where all gateways are managed by the central manager this is not a problem but third party devices do not support this.&nbsp;</SPAN></P><P><SPAN>Has any one come across&nbsp;this situation before and have a solution or is this a by design feature?</SPAN></P> Wed, 03 Apr 2019 10:55:33 GMT https://community.checkpoint.com/t5/General-Topics/VPN-to-third-party-in-an-ISP-HA-configuration-with-probing/m-p/49699#M9752 Nigel_Dennison 2019-04-03T10:55:33Z https://community.checkpoint.com/t5/General-Topics/VPN-to-third-party-in-an-ISP-HA-configuration-with-probing/m-p/49761#M9774 I'm pretty sure this is "by design."<BR />Refer to: <A href="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk116772" target="_blank">https<span class="lia-unicode-emoji" title=":confused_face:">😕</span>/supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk116772</A> Thu, 04 Apr 2019 00:16:59 GMT https://community.checkpoint.com/t5/General-Topics/VPN-to-third-party-in-an-ISP-HA-configuration-with-probing/m-p/49761#M9774 PhoneBoy 2019-04-04T00:16:59Z