topic Re: Site to Host IPSEC VPN ISP redundancy with Gateway behind static NAT in SASE and Remote Access

Site to Host IPSEC VPN ISP redundancy with Gateway behind static NAT

Travis_G — Sun, 03 May 2020 09:44:53 GMT

Hi,

I am trying to add a new ISP to my current setup so as to achieve redundancy for my remote user in case 1 of the ISP when down. The setup is as such. Firmware used is R80.10

ISP1 ISP2(New)

| |

Switch------------- Switch

| / \ |

Load balancer -------Load balancer (Static Nat)

| |

Switch------------Switch

| |

CP1-----------------CP2 (Active-Passive ClusteXL)

However it appears that only 1 ISP can be active at a time. Static NAT field in link selection only allow 1 IP to be inserted.

When i change it to ISP2 ip the ISP2 tunnel is active and the ISP1 is down. Btw this is for remote access (IPSEC site to host).

When i try to select probing under link selection and insert the IP for 2 ISP, it does not work either.

Is there anyway i could make this work?

Re: Site to Host IPSEC VPN ISP redundancy with Gateway behind static NAT

PhoneBoy — Mon, 04 May 2020 04:57:29 GMT

Have you configured ISP Redundancy at all?
Not exactly sure how it'd work in this case where some other device is doing the NAT.

Re: Site to Host IPSEC VPN ISP redundancy with Gateway behind static NAT

huytq1786 — Fri, 05 Jun 2020 18:44:32 GMT

I have the same question. Can we have a ISP redundancy solution on the checkpoint ?

Re: Site to Host IPSEC VPN ISP redundancy with Gateway behind static NAT

Wolfgang — Fri, 05 Jun 2020 18:54:50 GMT

@huytq1786

yes, you can have ISP redundancy. You have to enable this if you have defined two external interfaces on the gateway.

But I think behind two different NAT devices ( as mentioned by @Travis_G ) this is not possible.

Wolfgang