Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
GabsOliv
Contributor
Jump to solution

Redundant VPN Tunnel

Hi

On Main site, will have an appliance with two internet connection (two ISP’s), with fixed IP. One Remote sites, (one internet connection with fixed IP), I need to establish a VPN to the main site.

Target is established to one of the ISP’s, if it fails, automatically the tunnel will be established to the other.

We only can do this, using VTI, correct? or is there any other option?

Thanks

1 Solution

Accepted Solutions
G_W_Albrecht
Legend
Legend

So you plan using ISP Load Sharing ? As you wrote, without HA...

CCSE CCTE CCSM SMB Specialist

View solution in original post

0 Kudos
14 Replies
Pedro_Espindola
Advisor

Actually, in the VPN site configuration, you can set it to HA. You don't need VTIs. Works very well between 2 SMB appliances.

Are all the sites Check Point appliances?

GabsOliv
Contributor

Hi

All the sites will be checkpoint SMB appliances, but without HA. 

0 Kudos
G_W_Albrecht
Legend
Legend

So you plan using ISP Load Sharing ? As you wrote, without HA...

CCSE CCTE CCSM SMB Specialist
0 Kudos
GabsOliv
Contributor

Hi

My plan is use ISP Load Sharing on the main site. Remote site's will connect to Main, using vpn. The S2S VPN will be established to Interface in ISP1. If ISP1 fails, need to establish S2S VPN to ISP2.

As far as i can see, the only way to do it is using VTI tunnels. Any other idea ?

0 Kudos
G_W_Albrecht
Legend
Legend

No other idea.

CCSE CCTE CCSM SMB Specialist
0 Kudos
Pedro_Espindola
Advisor

"If ISP1 fails, need to establish S2S VPN to ISP2"

That is High Availability. You can use it domain based, no need to use VTIs. Here is what you have to do in the remote sites:

Ricardo_Gros
Collaborator

Hi Pedro, 

Have you tried this with the main Site being on Load Sharing? 

I´m wondering if this wont create confusion if the Tunnel is initiated from the Central Gateway. 

0 Kudos
Pedro_Espindola
Advisor

He can also use the Load Sharing option.

Or he can set the option "only remote site initiates the connection" when configuring the site in the Main Gateway.

GabsOliv
Contributor

Network diagram

Ricardo_Gros
Collaborator

Hi Gabriel, 


From the design it seems you want to have 2 Permanent tunnels as redundancy and not have 1 tunnel establish on active Link.  I don´t think you can do this over ISP load sharing (but never tried) and the 2 option seems simpler. 

For your design I think you need Route based VPN.

0 Kudos
Pedro_Espindola
Advisor

I had issues trying to use VTIs for redundancy. It works well on NON-SMB appliances, but how do I set the route as monitored in the little ones?

When Tunnel goes down, the primary route remains UP and we get no traffic.

Then I found out about the HA option, gave up on VTIs and had no more problems for SMB to SMB tunnels.

Ricardo_Gros
Collaborator

Hi, 


When we did this we used Dynamic routing, so the routes where not advertised if one of the links was down. 

At the time I did not find a way to have something like ping probing. However eventually if you route to the VTI interface directly (not the IP but the VTI ID can be selected) it removes the route? To be honest never tried this with static routes. 

0 Kudos
Pedro_Espindola
Advisor

No, the route remains active no matter what happens. I guess only dynamic routing will work, as you said.

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Correct, please refer known limitation: SMB-2668

CCSM R77/R80/ELITE
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events