topic Re: RA VPN failover with two ISP in SASE and Remote Access

RA VPN failover with two ISP

Vignesh_RS — Tue, 14 Apr 2020 11:55:16 GMT

We are having two SG in cluster mode (Active/Standby), currently with one ISP. We have planned to have secondary ISP with Active/Active mode & load sharing.

For RA VPN, endpoints are configured with ISP1 cluster IP 1.2.3.4.

Now, after ISP redundancy and load sharing with ISP2. For RA VPN, if we configure one more site with ISP2 cluster IP 5.6.7.8 at endpoint will it works during primary fails. (User has to disconnect site1 and manually connect to site2).

Is there any other configurations needs to be done at firewall level for VPN routing?

5800, GAIA R80.10.

Re: RA VPN failover with two ISP

_Val_ — Thu, 16 Apr 2020 12:41:43 GMT

Are you talking about ISP redundancy in the Load Sharing mode with two ISPs?

If yes, read the manual for it: https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_ClusterXL_AdminGuide/html_frameset.htm?topic=documents/R80.10/WebAdminGuides/EN/CP_R80.10_ClusterXL_AdminGuide/150990

Re: RA VPN failover with two ISP

Vignesh_RS — Mon, 20 Apr 2020 17:48:35 GMT

Thanks for the information provided, we have already configured ISP redundancy with load sharing.

After that, in remote access VPN only ISP 1 work, if we try to connect to ISP 2 from remote access VPN it doesn't connect.

If ISP 1 goes down, remote access VPN should work through ISP 2. How to configure the same?

Thanks in advance.

Re: RA VPN failover with two ISP

Prabulingam_N1 — Tue, 26 May 2020 14:51:12 GMT

Hi Vignesh,

For now, there is no ISP Redundancy on Remote Access refer - sk113617

But there were some workaround provided to configure 2nd Default route used for working in CheckMates.

"https://community.checkpoint.com/t5/Remote-Access-Solutions/How-to-configure-VPN-Remote-Access-on-non-default-Internet-Link/m-p/81991"

Regards, Prabu

Re: RA VPN failover with two ISP

Sony_James — Mon, 22 Feb 2021 06:18:51 GMT

Any Solution on this in new R81 or EA R81.10 version?

Re: RA VPN failover with two ISP

Prabulingam_N1 — Mon, 22 Feb 2021 07:28:42 GMT

Not yet SonyJames in R81.x for now....