topic Re: How to configure main and secondary VPN's from checkpointFW to one ASA in Spark Firewall (SMB)

How to configure main and secondary VPN's from checkpointFW to one ASA

torrefacto — Tue, 10 Aug 2021 18:27:29 GMT

How to configure two different VPNs (one primary and one secondary) to the Cisco ASA of a partner company, each one from a different ISP?

The idea is to have the maximum possible redundancy in case of loss of an ISP, VPN downtime....etc... to be able to continue working.

How could I configure the checkpoints for this? is it necessary to change the routes? and the Nateo?

Anyway, I am opened to whatever topology alternative.

I attached my topology proposal

Best regards.

Re: How to configure main and secondary VPN's from checkpointFW to one ASA

PhoneBoy — Tue, 10 Aug 2021 21:24:55 GMT

A couple of questions:

How are the 1570s managed in this case?
The diagram seems to indicate the two ISP links are terminating on an external router off the WAN interface, is that correct?

Re: How to configure main and secondary VPN's from checkpointFW to one ASA

torrefacto — Wed, 11 Aug 2021 07:11:57 GMT

Hi!

1 - They are master - Standby (ClusterXL)

2 - Yes, they are connected in level 3 switch the two ISP's routers. My Idea is (but i could be wrong) to have redundant VPN to the Cisco ASA in whatever situation. If the ISP1 router is down or the other one is down.

Kind regards.

Re: How to configure main and secondary VPN's from checkpointFW to one ASA

torrefacto — Wed, 11 Aug 2021 07:24:01 GMT

Also to me more understandable, i want to do something like https://www.cisco.com/c/en/us/support/docs/security-vpn/security-vpn/216709-configure-failover-for-ipsec-site-to-sit.html but with two Checkpoint and one Cisco ASA instead of two Cisco FTD and one Cisco ASA.

Kind regards.