topic Checkpoint Client VPN in SASE and Remote Access

Checkpoint Client VPN

Wayne_Hammond — Mon, 09 Nov 2020 13:58:26 GMT

Hi,

I just configured a second CP FW as a VPN gateway in the Remote Access VPN Community.

Myself and my colleague could connect and establish VPN's on both FW1 and FW2 objects

others when connecting to FW1 were being prompted with additional logon screens, presumably for FW2 object.

how can I disable this so that we can have VPN on FW1 object and if it fails we can VPN to FW2 object?

Cheers

Wayne

PhoneBoy — Mon, 09 Nov 2020 20:37:45 GMT

Sounds like Secondary Connect at work here.
Did you configure MEP?
How are Site A/B connected otherwise?

G_W_Albrecht — Mon, 09 Nov 2020 20:47:42 GMT

Look into Remote Access VPN R80.40 Administration Guide p.143ff and Attribute Sub-Category = MEP in sk75221: Remote Access TTM Configuration

Wayne_Hammond — Mon, 09 Nov 2020 22:12:37 GMT

Hi PhoneBoy,

FW1 & 2 are independent, not clustered.

With MEP set to backup, I can VPN to second FW, but cannot connect to any services via Endpoint client, but can via Capsule client.

Wayne_Hammond — Mon, 09 Nov 2020 22:12:53 GMT

Thanks i'll take a look