Configuring Remote Access VPN Redundancy with Multiple ISPs

[kristait]

Hello Check Point Community,

We currently have multiple Internet Service Providers (ISPs) and have configured our remote access VPN using the primary link. However, we have noticed that if the primary link goes down, the VPN connection also drops, causing significant disruptions. We are looking for a solution to ensure VPN redundancy.

Has anyone successfully configured a redundant remote access VPN setup with multiple ISPs? If so, could you please share your configuration steps or any best practices to achieve this? Any guidance on failover configurations or relevant documentation would be greatly appreciated.

Device Details: - checkpoint quantum 1800 local managed firewall.

[PhoneBoy]

This might be an RFE.
You can try this, though: https://support.checkpoint.com/results/sk/sk174207

[kristait]

looks like the feature is not included in the product..

[PhoneBoy]

If your gateway has DDNS configured, you might be able to do this: https://support.checkpoint.com/results/sk/sk103440 
Otherwise, you're probably in RFE territory.

[Maksimus]

Hello PhoneBoy

sk174207 is unavailable.(error 404). 

kristait,

Did you find solution for RA Redundancy with Multiple ISPs?

[kristait]

Hello @Maksimus, we switch to another Cloud hosted VPN, but the SK is related to configure the DDNS in your firewall with DDNS provider like No-IP.

[PhoneBoy]

The SK has been recently moved to internal only.
In the case of DAIP for the WAN connections, it's probably not the most appropriate solution, either.
Using the DDNS configuration here is probably your best bet: https://support.checkpoint.com/results/sk/sk103440 

[Maksimus]

Many thanks, PhoneBy

In my case i have Static IP and Quantum Force 9100. 

As far as I understand you propose to use DDNS. But it looks like applicable for GAIA embedded only. 

What about GAIA R81.20. I did not find any DDNS configuration for it

[PhoneBoy · Accepted solution]

The original poster is talking about Quantum Spark appliances, which have different UI/capabilities in this area.
You can still use DDNS, of course, but it would require setting that up on your own as regular Quantum gateways don't do this.

However, if both ISPs have a fixed IP, the approach in sk174207 would likely work.
You would have to review the situation with TAC.

[Maksimus]

Thanks a lot, @PhoneBoy 

I will contact with TAC