cancel
Showing results for 
Search instead for 
Did you mean: 
Post a Question

Redundant VPN Tunnel

Jump to solution

Hi

On Main site, will have an appliance with two internet connection (two ISP’s), with fixed IP. One Remote sites, (one internet connection with fixed IP), I need to establish a VPN to the main site.

Target is established to one of the ISP’s, if it fails, automatically the tunnel will be established to the other.

We only can do this, using VTI, correct? or is there any other option?

Thanks

1 Solution

Accepted Solutions

Re: Redundant VPN Tunnel

Jump to solution

So you plan using ISP Load Sharing ? As you wrote, without HA...

0 Kudos
13 Replies

Re: Redundant VPN Tunnel

Jump to solution

Actually, in the VPN site configuration, you can set it to HA. You don't need VTIs. Works very well between 2 SMB appliances.

Are all the sites Check Point appliances?

Re: Redundant VPN Tunnel

Jump to solution

Hi

All the sites will be checkpoint SMB appliances, but without HA. 

0 Kudos

Re: Redundant VPN Tunnel

Jump to solution

So you plan using ISP Load Sharing ? As you wrote, without HA...

0 Kudos

Re: Redundant VPN Tunnel

Jump to solution

Hi

My plan is use ISP Load Sharing on the main site. Remote site's will connect to Main, using vpn. The S2S VPN will be established to Interface in ISP1. If ISP1 fails, need to establish S2S VPN to ISP2.

As far as i can see, the only way to do it is using VTI tunnels. Any other idea ?

0 Kudos

Re: Redundant VPN Tunnel

Jump to solution

No other idea .

0 Kudos

Re: Redundant VPN Tunnel

Jump to solution

"If ISP1 fails, need to establish S2S VPN to ISP2"

That is High Availability. You can use it domain based, no need to use VTIs. Here is what you have to do in the remote sites:

Re: Redundant VPN Tunnel

Jump to solution

Hi Pedro, 

Have you tried this with the main Site being on Load Sharing? 

I´m wondering if this wont create confusion if the Tunnel is initiated from the Central Gateway. 

0 Kudos

Re: Redundant VPN Tunnel

Jump to solution

He can also use the Load Sharing option.

Or he can set the option "only remote site initiates the connection" when configuring the site in the Main Gateway.

Re: Redundant VPN Tunnel

Jump to solution

Network diagram

Re: Redundant VPN Tunnel

Jump to solution

Hi Gabriel, 


From the design it seems you want to have 2 Permanent tunnels as redundancy and not have 1 tunnel establish on active Link.  I don´t think you can do this over ISP load sharing (but never tried) and the 2 option seems simpler. 

For your design I think you need Route based VPN.

0 Kudos

Re: Redundant VPN Tunnel

Jump to solution

I had issues trying to use VTIs for redundancy. It works well on NON-SMB appliances, but how do I set the route as monitored in the little ones?

When Tunnel goes down, the primary route remains UP and we get no traffic.

Then I found out about the HA option, gave up on VTIs and had no more problems for SMB to SMB tunnels.

Re: Redundant VPN Tunnel

Jump to solution

Hi, 


When we did this we used Dynamic routing, so the routes where not advertised if one of the links was down. 

At the time I did not find a way to have something like ping probing. However eventually if you route to the VTI interface directly (not the IP but the VTI ID can be selected) it removes the route? To be honest never tried this with static routes. 

0 Kudos
Highlighted

Re: Redundant VPN Tunnel

Jump to solution

No, the route remains active no matter what happens. I guess only dynamic routing will work, as you said.

0 Kudos