Site to Site VPN - Remote Network not routed via default-route

[maad-pul]

Hi,

I have a setup where I route 10.210.0.0/16 to WAN-MPLS service provider, each Office/Shop has its own /24 network within this /16.
I have a problem with MPLS-Fiber is broken to one Office, so I would like to run this network (10.210.3.0/24) over Site 2 Site VPN instead.  Can this be done in 81.10 with latest jumbo and Cloud Guard HA-gateway pair?

I think I have had problem with this in VSX back in the days (don´t know which version).
In Cisco ASA I can handle this problem by routing 10.210.3.0/24 to default gatway for the internet. I didn´t get this worked back in the days in Check Point, the solution was to start subnet routing to MPLS with smaller net so 10.210.3.0/24 used default route to ISP. Check Point VSX couldn´t build a VPN-tunnel when network in Remote VPN domain was included in a route to a MPLS provider instead of default route.

10.210.1.0/24 -> MPLS
10.210.2.0/24 -> MPLS
--- 10.210.3.0/24 --- SKIPPED AND DEFAULT ROUTE USED
10.210.4.0/24 -> MPLS
10.210.5.0/24 -> MPLS

Whats your thought about this? Can you have a Remote Network via Site to Site VPN thats routed to someting elese then default route within Check Point infrastrucutre. The VPN-setup is old school with VPN-domains etc. VTI maybe can solve the issue?.

Regards
Mattias

[PhoneBoy]

There isn’t a specific requirement to route VPN traffic out the default route.
In fact, if you’re using Link Selection with multiple interfaces, you actually need to use non-default routes to reach certain destinations and use the correct IP.

Where you might have had issues is with the encryption domain and routing.
And yes, you do need to be mindful of that.
Using VTIs (with a “null” encryption domain) should work also.

[Wolfgang]

@maad-pul if subnet 10.210.3.0/24 is configured in the enctryption domain of your remote gateway the VPN will be used, no route needed.

Usually you can configure a high available connection with one MPLS connection and VPN as backup How To Create a Redundant, Service-based MPLS/Encrypted Link VPN 

[maad-pul]

Just for information, Remote Device is an 3rd-party device (Interoperable Device). I don´t know if this change your opintion that this setup will be working? I haven´t have time to set up a lab yet, but as I said, according to information from a few years back I had problem in my VSX-environment to handle VPN when remote destination network were included in a "bigger" static route to MPLS provider. 

[Wolfgang]

@maad-pul The mentioned solution does not work with third party devices. Your line is lost at the moment. Why not setting up the correct VPN configuration for the known remote network and additional you can configure a route for your smaller remote network via the default gateway. You‘re known problems are a few years back, you can give it a try now.