Harmony sase vpn redundant vpn tunnel tip

[the_rock]

Hey guys,

Figured would share this, since my colleague and I spent lots of hours into testing this with BGP for a client that purchased SASE solution. Since sd-wan is not supported yet and we dont have an idea when it will be with sase, we made it work where redundant vpn tunnels work flawlessly with BGP implemented.

Guide:

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/Content/Topi...

But, the way to make this work 100% is NOT to set it where you have CP cluster as center gw and interoperable objects presenting sase pops as satellite, but the other way around, where interoperable ones are center and CP is satellite and then you enable MEP and choose middle option (default one, closest choise) in vpn community (should be configured as star)

This works without issues. We will actually show this to CP sase expert, as well as SE guy when we have a call with them, so documentation can be hopefully modified to reflect that, as it would save lots of time for others trying to do the same.

We are using BGP per overlay, since we found works better that way, mind you, using BGP loopback interface does offer better scalability.

Happy to share any screenshots if needed.

Best,

Andy

[_Val_]

Do share the screenshots 🙂

[the_rock · Accepted solution]

Since we want to make sure this would be officially supported by CP, we asked our SE if sk could be written about it, or at least included in the documentation. Obviously, we dont want client to have an issue say a year from today and then we are told by TAC this is not supported...anyway, lets see what comes out of that, but regardless, screenshots attached : - )

Andy

[_Val_]

Or you can ask TAC about the support status. It is considered an official answer.

[the_rock]

Speaking of that, we figured it would be best to go through our SE, but if you have an email or contact I could present this to, that would work as well.

Thanks Val.

Andy

[_Val_]

What I mean, you can open a TAC ticket to ask about the support status.

[the_rock]

Ah, I see what you are saying. Thats true, we can always do that, but we would definitely prefer that process be documented somewhere officially, so there is no ambiguity.

Anywho, lets see what SE says : - )

Thanks Val as always!

Andy