Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Renjith_M_P
Contributor

VPN Solution

Hi All,

As shown in the diagram, i have a requirement. Site 1 is connected with Remote Site (marked as permanent tunnel) this is working and up. now i need to configure Redundant Tunnel between Site 2 and Remote Site. as per my understanding MEP will work only with checkpoint. what other solution can be provide here and how do i define priority and route.

8 Replies
G_W_Albrecht
Legend
Legend

I just can see a Cisco ASA here - where is which Version/type of CP VPN GW you want a solution for ?

CCSE CCTE SMB Specialist
0 Kudos
Renjith_M_P
Contributor

checkpoint at both site is managed by same management

Version

CP -77.30

ASA-9.x

0 Kudos
Renjith_M_P
Contributor

CP -77.30

ASA-9.x

0 Kudos
G_W_Albrecht
Legend
Legend

So both CPs have only one VPN tunnel each, but ASA has one main (permanent) and one redundant VPN tunnel - please correct me if i am wrong. So all redundancy configuration must be done on ASA - maybe a Cisco Forum would be more appropriate for this question .

CCSE CCTE SMB Specialist
0 Kudos
Renjith_M_P
Contributor

No,traffic initiator is CP. there is only one VPN tunnel between Site 1 and Remote ASA site. i need to implement a new backup tunnel from site 2 to Remote ASA. in this setup primary tunnel is Site1 to remote ASA. in case of any failure at site 1, the traffic should pass through Site 2 to Remote ASA. 

0 Kudos
G_W_Albrecht
Legend
Legend

Route Based VPN could be adequate to this scenario, using Numbered VTI. See this discussion:

https://community.checkpoint.com/thread/6641-how-can-i-setup-a-primary-and-backup-s2s-vpn-tunnels

CCSE CCTE SMB Specialist
Timothy_Hall
Champion
Champion

If heading down the route-based VPN path, R80.10 or later on the gateway is strongly recommended.  Prior to R80.10 the utilization of the route-based VPN feature required CoreXL to be disabled (i.e. only one Firewall Worker/kernel instance for all traffic processing).

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

New 2021 IPS/AV/ABOT Self-Guided Video Series
now available at http://www.maxpowerfirewalls.com
0 Kudos
Houssameddine_1
Collaborator

if checkpoint gw protecting the same networks and if you don't want to use route based vpn you can try to apply NAT on one of the checkpoint gateways to present different networks for the ASA as encryption domain.

0 Kudos