Two interoperable devices with same encryption domain for VPN failover?

[jure]

Hi all,

I need to build a redundant Site-to-Site VPN between a Check Point ClusterXL running R81.10 and a Huawei Gateway with two WAN interfaces. The Huawei device has two public WAN IPs, but both links use the same encryption domain. WAN2 should only be used as a backup/failover link, no load balancing is required.

Currently a domain-based VPN with a single WAN link is already working without issues.

I would like to know what is considered best practice on the Check Point side for implementing WAN redundancy in this kind of setup. Is it supported to create two interoperable devices (one per Huawei WAN IP), use the same encryption domain on both objects, and add both as satellite gateways into the same VPN community? 

Or is it strictly recommended to use Route-Based VPN in this setup?

Thanks in advance!

[PhoneBoy]

This SK suggests you can do it without resorting to Route-Based VPN: https://support.checkpoint.com/results/sk/sk164355