ISP Redundancy, VPN Tunnels and the CRL - Main IP

[John_Richards]

Hello, we have a number of R81.20 GW's (Fully Patched and not SMB) that have VPN tunnels (all Check Point) back to a central site. I have reviewed a number of SK (including 25152 and 174197). The remote GW's have ISP redundancy configured in a Primary/Backup scenario. Let's assume Primary ISP is 10.1.1.1 and Backup is 192.168.1.1. The cluster has 10.1.1.1 as it's main IP as displayed in SmartConsole. We failover to Backup (192.168.1.1) and main IP is still displayed as 10.1.1.1. My understanding is that you do not need to change the main IP address on the cluster. After a day or 2 we notice that the VPN tunnel drops for no reason (still on backup ISP and can see no issue with the ISP connection). If we flip back to the Main IP, the tunnel is up. Our theory is that the VPN certificate gets revoked after a period of time and tunnel goes down even though we see both IP's in the certificate. We have not tested this as a production environment and I am still searching for related logs. We have also reached out to our CP Security Engineer to get clarification. Any ideas or comments?

[simonemantovani]

How did you configured the Link Selection section under VPN IPSec?

[John_Richards]

We have Apply settings to VPN traffic selected. The Link Selection is greyed out but Main Address is selected. As noted the Tunnel comes up if we flip to backup ISP. Is after a certain time that the tunnel just seems to drop

[elbergfeldt]

I have configured similar settings and never had an issue...  Have you ensured Check Point RDP probing (UDP/259) is allowed to and from the other members in the VPN community?  Is there any information in the VPN/IKE logs regarding why the connection drops (like "Certificate Invalid")? 

[the_rock]

I think you are right, though I would double check the routes as well when this happens, just the priority, as one with lower priority number would take presedence.