topic Re: VPN connection via two providers in SASE and Remote Access

VPN connection via two providers

Rannekww — Fri, 18 Nov 2022 09:33:07 GMT

Checkpoint 4400.

There used to be one provider. Now the second one has been connected.
The question arose: is it possible to connect via VPN through two providers at the same time? Do I need to add anything else? Or do I need to reissue the certificate for the gateway by adding the IP of the second provider to it?

I want to connect from a desktop computer via Checkpoint EndPoint Security via two IP addresses. The first IP is provider A and the second IP is provider B. By IP provider A, the connection is successful. A by IP provider B: Failed to create the new site. Site is not responding.

Re: VPN connection via two providers

G_W_Albrecht — Fri, 18 Nov 2022 08:26:28 GMT

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Quantum_SecurityGateway_Guide/Topics-FWG/ISP-Redundancy-and-VPN.htm?Highlight=Configuring%20ISP%20Redundancy%20on%20a%20Security%20Gateway

sk116772: ISP Redundancy "Apply settings for VPN traffic" is not working with 3rd party vendors

Re: VPN connection via two providers

RS_Daniel — Fri, 18 Nov 2022 13:36:29 GMT

Hello,

You can check sk174207, it says "E75.X / E8X.X clients only support static link selection (sk56580 Link Selection)." and gives you a workaround if you are working with ISP redundancy.

I have it working on some customers with DNS, each public IP has its own FQDN, then applied sk103440 to force DNS resolution on every connection.

Regards

Re: VPN connection via two providers

the_rock — Sat, 19 Nov 2022 04:35:48 GMT

Here are 2 articles we did for customer last year to make this work, though they had DNS resolve to 2 external IP addresses. So say 2 external IP addresses 1.2.3.4 and 5.6.7.8 resolve to vpn.xyz.com

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk131612&srcFavorites=favorites

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103440&srcFavorites=favorites

Actually, scrap the 2nd link I sent, I checked and we only did 1st one and all worked. Also, below points out that automatic failover does not work (not supported) with remote access.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113617&srcFavorites=favorites

Re: VPN connection via two providers

Rannekww — Sat, 19 Nov 2022 08:04:37 GMT

Thanks. I'll take a look.

Re: VPN connection via two providers

Rannekww — Sat, 19 Nov 2022 08:06:57 GMT

Thanks. We will have to manually reconfigure remote access if necessary.

Re: VPN connection via two providers

Rannekww — Sat, 19 Nov 2022 08:29:18 GMT

Last question: There is an ISP Links in order of priority field in ISP Redundancy. There are two ISPs there now. As the Next Hop IP Address, I specify the gateway of another provider. Is it also correct? Since I noticed that, depending on what I write there, the gateway from this location (Next Hop IP Address) is registered in the Checkpoint web interface in IPv4 Static Routes.
~~Or is the gateway specified here not of another provider?~~

The question is removed

Re: VPN connection via two providers

the_rock — Sun, 20 Nov 2022 00:28:18 GMT

Ping me privately if you need help, Im sure we can figure it out via remote session.

Cheers.