VPN Redundancy without using Dynamic Routing

[JaySon_2021]

We have 3 sites. All of them use Checkpoint firewalls (R82.10). We want to have full redundancy between all sites.

Examples:

- If VPN-A goes down, we want Site1 to go to Site2 to get to Site3, and the reverse (Site3 --> Site2 --> Site1)

- If VPN-B goes down, we want Site1 to go to Site3 to get to Site2, and the reverse

Etc.

We want to accomplish this without using Dynamic Routing (OSPF, BGP) as these are not large sites and we want to simplify supporting it.

Is this possible without using Dynamic Routing? Can it be done using Domain Based VPNs?

[simonemantovani]

In my opinion dynamic routing protocol will simplify your infrastructure my making it more automatic everything.

If you don't want to use route based vpn, but you want to use domain based vpn, you need to manage manually the encryption domain adapting them when a failure occurs (you can't have the network in all the encryption domains for all the firewall in vpn community.

I understand what you write but dynamic routing (BGP) and routed based vpn is the best configuration you can implement.

[JaySon_2021]

Thanks Simonemantovani

What if I just wanted the following 2 scenarios solved:

- If VPN-A goes down, we want Site1 to go to Site2 to get to Site3, and the reverse (Site3 --> Site2 --> Site1)

- If VPN-C goes down, we want Site2 to go to Site1 to get to Site3, and the reverse

If VPN-B goes down between Site1 and Site2, so be it - we wait for it to come back up. As long as Site1 can still get to Site3 (not routing through it to Site2), and Site2 can still get to Site3 (not routing through it to Site1)

Would this be possible, without Dynamic Routing, and not require manual intervention?

[simonemantovani]

Without diynamic routing you need manual intervention to adapt the encryption domain to avoid overlapping encryption domain.

[Bryan-Smith]

@JaySon_2021, If Site1 loses its direct VPN to Site3, traffic can either stop immediately or automatically reroute via Site2. The behavior depends entirely on whether backup static routes are configured. No dynamic routing is required, but bidirectional route design is critical. 

Backup routing in a Check Point Route Based mesh VPN is achieved by pre‑staging higher‑metric static routes over alternate VTIs and relying on tunnel monitoring to withdraw primary routes during failure. 

Check Point's route-based VPN with numbered VTIs makes this feasible because you treat the tunnels like interfaces for static routing. 

As was stated by @simonemantovani this will not work with domain-based VPNs & I would not do this past three sites. Managing all of the static routes in each direction is prone to mistakes. 

[JaySon_2021]

Thanks @Bryan-Smith . Would this be done in a single mesh VPN? Or would each site have a separate Mesh VPN?