topic Re: IPsec VPN over MPLS in SASE and Remote Access

IPsec VPN over MPLS

Lucas_Piris — Fri, 29 Jun 2018 18:32:47 GMT

Hi,

Anyone known how configure a VPN IPSEC over MPLS?

Actually i have a tunel established using my ISP between two Check Point Gateway, now i have a MPLS link and i want to encrypt this traffic.

Devices:

1 Manager for Corporate and Branch Site;

1 Corporate Gateway;

1 Branch site Gateway.

My doubt is, i have some others tunnels using my ISP on Corporate gateway, if i change the link selector to use MPLS, how the VPN´s configured today understand this?

Best Regards

Lucas

Re: IPsec VPN over MPLS

PhoneBoy — Fri, 29 Jun 2018 20:27:55 GMT

Is the MPLS link on the same interface or a different interface from your ISP?

Assuming different, then I think if you use "Calculate IP Based on Network Topology" it should use the IP facing that network.

Re: IPsec VPN over MPLS

Lucas_Piris — Fri, 29 Jun 2018 21:07:03 GMT

Hi Dameon,

Thank you!

Yes, is a different interface.

I have ISP Redundancy configured also, with "Apply settings to VPN Traffic" because i have VPN established with anothers peers over internet and for redundancy of internet and the ipsec vpn with this peers.

Also, if i uncheck "Apply settings to VPN Traffic" and use "Calculate IP Based on Network Topology", Can i have a problem with link failover or with others tunnels?

Lucas

Re: IPsec VPN over MPLS

PhoneBoy — Mon, 02 Jul 2018 19:35:35 GMT

Depends on if the remote end of the MPLS VPN is Check Point or not.

See: IKE Main Mode negotiation fails with error "invalid id" when Check Point Security Gateway has ISP redundancy configured,…

Re: IPsec VPN over MPLS

Lucas_Piris — Mon, 02 Jul 2018 21:03:09 GMT

Hi Dameon,

Thank you for all your support.

Yes, is a check point.

Do you know what happens when I uncheck the option "Apply settings to VPN Traffic" from ISP redundancy settings?

I will lose the failover with others peers?

Regards

Lucas

Re: IPsec VPN over MPLS

PhoneBoy — Mon, 02 Jul 2018 21:11:25 GMT

I don't think you need to disable "Apply settings to VPN Traffic" in this case (but maybe I'm wrong here).

Re: IPsec VPN over MPLS

Lucas_Piris — Mon, 02 Jul 2018 22:53:35 GMT

Hi Dameon,

If i do not disable the option "Apply settings to VPN Traffic", I am not be able to change the link selection on the IPSec VPN tab.

Regards

Lucas

Re: IPsec VPN over MPLS

PhoneBoy — Mon, 02 Jul 2018 23:35:10 GMT

It should be ok.

It's similar to the following scenario in the documentation, which requires a couple extra steps to be done: Link Selection

Re: IPsec VPN over MPLS

Lucas_Piris — Tue, 03 Jul 2018 12:56:37 GMT

Hi Dameon,

Thank you so much.

I will try, I will be back with results.

Regards

Lucas

Re: IPsec VPN over MPLS

Lucas_Piris — Mon, 30 Jul 2018 17:03:12 GMT

Hi all,

The final solutions was:

Uncheck "Apply settings to VPN Traffic" from the ISP Redundancy settings.

Configure the Link Selection to probe my two ISP´s and the MPLS and set the primary address to MPLS.

Renew the certificates from Gateway 01 and Gateway 02 adding all ip address of ipsec as SAN.

Regards

Lucas