VPN Solution

[Renjith_M_P]

Hi All,

As shown in the diagram, i have a requirement. Site 1 is connected with Remote Site (marked as permanent tunnel) this is working and up. now i need to configure Redundant Tunnel between Site 2 and Remote Site. as per my understanding MEP will work only with checkpoint. what other solution can be provide here and how do i define priority and route.

[G_W_Albrecht]

I just can see a Cisco ASA here - where is which Version/type of CP VPN GW you want a solution for ?

[Renjith_M_P]

checkpoint at both site is managed by same management

Version

CP -77.30

ASA-9.x

[Renjith_M_P]

CP -77.30

ASA-9.x

[G_W_Albrecht]

So both CPs have only one VPN tunnel each, but ASA has one main (permanent) and one redundant VPN tunnel - please correct me if i am wrong. So all redundancy configuration must be done on ASA - maybe a Cisco Forum would be more appropriate for this question .

[Renjith_M_P]

No,traffic initiator is CP. there is only one VPN tunnel between Site 1 and Remote ASA site. i need to implement a new backup tunnel from site 2 to Remote ASA. in this setup primary tunnel is Site1 to remote ASA. in case of any failure at site 1, the traffic should pass through Site 2 to Remote ASA. 

[G_W_Albrecht]

Route Based VPN could be adequate to this scenario, using Numbered VTI. See this discussion:

https://community.checkpoint.com/thread/6641-how-can-i-setup-a-primary-and-backup-s2s-vpn-tunnels

[Timothy_Hall]

If heading down the route-based VPN path, R80.10 or later on the gateway is strongly recommended.  Prior to R80.10 the utilization of the route-based VPN feature required CoreXL to be disabled (i.e. only one Firewall Worker/kernel instance for all traffic processing).

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

[Houssameddine_1]

if checkpoint gw protecting the same networks and if you don't want to use route based vpn you can try to apply NAT on one of the checkpoint gateways to present different networks for the ASA as encryption domain.