topic Configuring Remote Access VPN Redundancy with Multiple ISPs in SASE and Remote Access

Configuring Remote Access VPN Redundancy with Multiple ISPs

kristait — Wed, 26 Jun 2024 06:59:42 GMT

Hello Check Point Community,

We currently have multiple Internet Service Providers (ISPs) and have configured our remote access VPN using the primary link. However, we have noticed that if the primary link goes down, the VPN connection also drops, causing significant disruptions. We are looking for a solution to ensure VPN redundancy.

Has anyone successfully configured a redundant remote access VPN setup with multiple ISPs? If so, could you please share your configuration steps or any best practices to achieve this? Any guidance on failover configurations or relevant documentation would be greatly appreciated.

Device Details: - checkpoint quantum 1800 local managed firewall.

Re: Configuring Remote Access VPN Redundancy with Multiple ISPs

PhoneBoy — Wed, 26 Jun 2024 22:18:09 GMT

This might be an RFE.
You can try this, though: https://support.checkpoint.com/results/sk/sk174207

Re: Configuring Remote Access VPN Redundancy with Multiple ISPs

kristait — Thu, 27 Jun 2024 04:28:20 GMT

looks like the feature is not included in the product..

Re: Configuring Remote Access VPN Redundancy with Multiple ISPs

PhoneBoy — Thu, 27 Jun 2024 15:19:42 GMT

If your gateway has DDNS configured, you might be able to do this: https://support.checkpoint.com/results/sk/sk103440
Otherwise, you're probably in RFE territory.

Re: Configuring Remote Access VPN Redundancy with Multiple ISPs

Maksimus — Mon, 07 Oct 2024 07:52:27 GMT

Hello PhoneBoy

sk174207 is unavailable.(error 404).

kristait,

Did you find solution for RA Redundancy with Multiple ISPs?

Re: Configuring Remote Access VPN Redundancy with Multiple ISPs

kristait — Mon, 07 Oct 2024 08:07:21 GMT

Hello @Maksimus, we switch to another Cloud hosted VPN, but the SK is related to configure the DDNS in your firewall with DDNS provider like No-IP.

Re: Configuring Remote Access VPN Redundancy with Multiple ISPs

PhoneBoy — Mon, 07 Oct 2024 13:54:12 GMT

The SK has been recently moved to internal only.
In the case of DAIP for the WAN connections, it's probably not the most appropriate solution, either.
Using the DDNS configuration here is probably your best bet: https://support.checkpoint.com/results/sk/sk103440

Re: Configuring Remote Access VPN Redundancy with Multiple ISPs

Maksimus — Mon, 07 Oct 2024 20:29:08 GMT

Many thanks, PhoneBy

In my case i have Static IP and Quantum Force 9100.

As far as I understand you propose to use DDNS. But it looks like applicable for GAIA embedded only.

What about GAIA R81.20. I did not find any DDNS configuration for it

Re: Configuring Remote Access VPN Redundancy with Multiple ISPs

PhoneBoy — Mon, 07 Oct 2024 22:54:09 GMT

The original poster is talking about Quantum Spark appliances, which have different UI/capabilities in this area.
You can still use DDNS, of course, but it would require setting that up on your own as regular Quantum gateways don't do this.

However, if both ISPs have a fixed IP, the approach in sk174207 would likely work.
You would have to review the situation with TAC.

Re: Configuring Remote Access VPN Redundancy with Multiple ISPs

Maksimus — Mon, 07 Oct 2024 23:02:42 GMT

Thanks a lot, @PhoneBoy

I will contact with TAC