topic Re: ISP Redundancy and Visitor Mode port configuration in SASE and Remote Access

ISP Redundancy and Visitor Mode port configuration

DmitryS — Mon, 11 Oct 2021 10:10:37 GMT

Good day!

I have a configuration with two providers.
For remote access clients, we changed the connection port to 8080 in the settings /Remote access -> Support Visitor Mode/. 443 port is busy for the WEB site.

The problem arises when the user connects.

If you specify in the /Link selection -> Use probing Link probing. Link redundancy mode/ menu and select two interfaces of providers. The client's configuration includes the internal gateway address, instead of those specified in the settings.

If you specify the address of one provider, the client connects.

How do we make the configuration work?

1. Setup one ISP - worked

2. Setup two ISP - not worked

3. Change Visitor Mode port to 8080

4. Configure ISP Redundancy

Re: ISP Redundancy and Visitor Mode port configuration

_Val_ — Mon, 11 Oct 2021 11:34:21 GMT

1. Do not use ongoing probing

2. Make sure probing is actually allowed on the FW via policy

3. Finally, 443 should still work, even you have Web site set up on it. Or did you configure PAT with FW addresses on that port?

Re: ISP Redundancy and Visitor Mode port configuration

Zabula_Sergey — Mon, 11 Oct 2021 11:51:16 GMT

Hello Dmitry!

Could you please contact me via mail? szabula (at) checkpoint.com