topic Re: Checkpoint Endpoint security client not able to connect with Secondary ISP in SASE and Remote Access

Checkpoint Endpoint security client not able to connect with Secondary ISP

Mallikarjun — Wed, 10 Aug 2022 07:39:20 GMT

Hello Team,

We have a set-up of 2 Checkpoint 5400 gateways in HA cluster mode.

For both the firewall we have 2 ISP configured one as Primary and another one as backup.

Users connect to gateway using "Checkpoint Endpoint security client" through Primary ISP.

But when there is failover users are able to connect to gateway only once through backup ISP.

As soon as the user disconnects the "Checkpoint Endpoint security client" he is not able to connect to the "Security client" and a failed message displays.

This occurs only when backup ISP is live.

There is no issue when Primary ISP is live.

Kindly help,

Mallikarjun

Re: Checkpoint Endpoint security client not able to connect with Secondary ISP

Chris_Atkinson — Wed, 10 Aug 2022 00:49:49 GMT

How is your link selection configured?

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_RemoteAccessVPN_AdminGuide/Topics-VPNRG/VPN-Routing-Remote-Access.htm?Highlight=link%20selection#Link_Selection_for_Remote_Clients

Re: Checkpoint Endpoint security client not able to connect with Secondary ISP

Mallikarjun — Wed, 10 Aug 2022 06:20:58 GMT

Hello Chris,

The link selection in ISPec VPN is configured as "Use probing:Link redundancy mode"-> High availability and probe primary address.