VPN S2S 2 ISPs + AWS

[IMCristian_Rosa]

Hello,

We have a cluster on R81.10, in which we have two links/ISP from different suppliers. We would like to enable redundancy for a VPN with AWS.
EX:
ISP 1
ISP2

In other words, having 2 active tunnels, when the ISP1 tunnel fails, the ISP2 tunnel is activated.

As we know that S2S VPNs with AWS are route based, we have already ruled out using link selection.

In a first conversation with AWS, they informed us that it will have to be done via BGP.

Has anyone already implemented this configuration?

[the_rock]

Why not use MEP? It applies if you have more than 1 center gateway, unless you are strictly referring to ISP redundancy?

Andy

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SitetoSiteVPN_AdminGuide/Topics-VP...

[IMCristian_Rosa]

Hello, The_Rock,

Tks for feedback.

What I need is ISP redundancy to have redundancy between two tunnels.


Tks

Cristian Rosa

[the_rock]

Hey mate,

Not so sure thats possible, because if you think about it logically, how would the AWS side ever know that there was ISP like change and would be aware of new external IP?

Andy

[IMCristian_Rosa]

Andy,

This scenario is common, how would I do VPN redundancy using VTI/AWS?

Is there no possibility?

Tks

Cristian Rosa

[PhoneBoy]

Have you tried this? https://support.checkpoint.com/results/sk/sk108958 

[IMCristian_Rosa]

Hello, PhoneBoy

Tks for feedback.

What I need is ISP redundancy to have redundancy between two tunnels.

[PhoneBoy]

From sk108958: "To detect when a tunnel goes down and to route traffic through the second tunnel, we use BGP."

[IMCristian_Rosa]

Hi,

But in this case, the reference is to the second tunnel on the AWS side. In AWS there will be redundancy, but on the Checkpoint side.

Note that there is only one peer/ISP on the Checkpoint side.

Tks

Cristian Rosa

[the_rock]

We had a client who wanted similar thing and we did end up using BGP, though this was Azure, but literally the same concept.