topic Re: Harmony sase vpn redundant vpn tunnel tip in SASE and Remote Access

Harmony sase vpn redundant vpn tunnel tip

the_rock — Mon, 07 Jul 2025 23:30:04 GMT

Hey guys,

Figured would share this, since my colleague and I spent lots of hours into testing this with BGP for a client that purchased SASE solution. Since sd-wan is not supported yet and we dont have an idea when it will be with sase, we made it work where redundant vpn tunnels work flawlessly with BGP implemented.

Guide:

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/Content/Topics-SASE-IPsec-VPN/On-premises/ConfiguringCheckPointRedundantIPSecTunnel.htm?tocpath=Networks%7CIntegrating%20On-premises%20Firewall%20%252F%20Router%20or%20Cloud%20based%20Resources%7COn-premises%20Firewall%20-%20Configuring%20the%20Tunnel%20in%20the%20Management%20Portal%7C_____5

But, the way to make this work 100% is NOT to set it where you have CP cluster as center gw and interoperable objects presenting sase pops as satellite, but the other way around, where interoperable ones are center and CP is satellite and then you enable MEP and choose middle option (default one, closest choise) in vpn community (should be configured as star)

This works without issues. We will actually show this to CP sase expert, as well as SE guy when we have a call with them, so documentation can be hopefully modified to reflect that, as it would save lots of time for others trying to do the same.

We are using BGP per overlay, since we found works better that way, mind you, using BGP loopback interface does offer better scalability.

Happy to share any screenshots if needed.

Best,

Andy

Re: Harmony sase vpn redundant vpn tunnel tip

_Val_ — Thu, 10 Jul 2025 08:15:18 GMT

Do share the screenshots 🙂

Re: Harmony sase vpn redundant vpn tunnel tip

the_rock — Thu, 10 Jul 2025 11:49:42 GMT

Since we want to make sure this would be officially supported by CP, we asked our SE if sk could be written about it, or at least included in the documentation. Obviously, we dont want client to have an issue say a year from today and then we are told by TAC this is not supported...anyway, lets see what comes out of that, but regardless, screenshots attached : - )

Andy

Re: Harmony sase vpn redundant vpn tunnel tip

_Val_ — Thu, 10 Jul 2025 11:59:24 GMT

Or you can ask TAC about the support status. It is considered an official answer.

Re: Harmony sase vpn redundant vpn tunnel tip

the_rock — Thu, 10 Jul 2025 12:01:07 GMT

Speaking of that, we figured it would be best to go through our SE, but if you have an email or contact I could present this to, that would work as well.

Thanks Val.

Andy

Re: Harmony sase vpn redundant vpn tunnel tip

_Val_ — Thu, 10 Jul 2025 12:21:10 GMT

What I mean, you can open a TAC ticket to ask about the support status.

Re: Harmony sase vpn redundant vpn tunnel tip

the_rock — Thu, 10 Jul 2025 12:23:45 GMT

Ah, I see what you are saying. Thats true, we can always do that, but we would definitely prefer that process be documented somewhere officially, so there is no ambiguity.

Anywho, lets see what SE says : - )

Thanks Val as always!

Andy