ISP redundancy and remote access

[Ilovecheckpoint]

Hello, 

In our organization, gateways, are appliances on HA and managed by public ip address, on distributed environment.

External gateways are connected to Internet via layer 2 switches.

Remote sites have dual ISP, configured as primary/backup ISP redundancy.

PC use ipsec vpn on office mode.

When ISP1 fails, vpn site to site peer works correctly, as per Checkpoint mechanism to modify default route via ISP2 (even if it is not possible to install policies when ISP1 fails).

Anyway, we would love to achieve, pc on vpn, on case of ISP1 fails, to continue to work switching automatically ( as preferred ) to isp2.

Currently, it doesn't work and even configuring manually on a pc, as site the gateway ISP2 address , the remote access vpn doesn't turn on.

Is there any solution?

[PhoneBoy]

See: https://support.checkpoint.com/results/sk/sk174207
The user will have to reconnect when the connection fails over.

[EVSolovyev]

hello. it seems, sk174207 have been removed. interesting why.

[PhoneBoy]

This SK has been moved to Internal partition per R&D.
The procedure in this SK was a bit of a workaround involving MEP that didn't work for everyone.
Officially, "This feature is not included in the product. If you need it, please submit a Request for Enhancement as described in sk71840."
I would also engage with your local Check Point office.

[EVSolovyev]

Okay, thank you for the information.

[the_rock]

I tried accessing that same sk the other day and was surprised it was not available. Now it makes sense as to why 🙂

Andy