Quantum Spark IPsec tunnel failover

[CheckCheckM]

Hello all,

I have a question regarding quantum spark 1800 (R81.10), i have two ipsec between Check point add peer-firewalls with below scenario

 

. But i cannot setup auto failover for both tunnel, swing manual currently. Is there any idea to solve? thanks much, everyone. 

[Chris_Atkinson]

Locally or centrally managed appliance with domain or Route based tunnels?

[CheckCheckM]

locally managed. i did using domain coz route base tunnel does not work. 

[Chris_Atkinson]

If the encryption domains are the same this will likely be problematic (sk114652). 

Regarding route based, it didn't work in what way we're you using dynamic or static routing?

Else you may need to explore ISP redundancy. 

[CheckCheckM]

Thanks @Chris_Atkinson . I'm using static routing but i think, as my scenario, if possible, i prefer to setup route based coz wan link redundancy for both side.

[Chris_Atkinson]

Unfortunately static routes won't work with route based VPNs for redundancy - known limitation.

If you need this specifically versus dynamic routing please discuss it further with your local SE as an RFE.

[G_W_Albrecht]

Redundant VPN Tunnel

[CheckCheckM]

Thanks much @G_W_Albrecht . As my scenario, if possible, i prefer to setup route based coz wan link redundancy for both side. can u pls share route based config guide. Is that need to use VTI in router based?

If i used connection type HA with domain base, peer device (non-checkpoint) need to setup 4 tunnels like mesh. that's why, i prefer router based.

[Tom_Hinoue]

Failover (metric based) using VTIs over 2 IPSec tunnels is currently a limitation and not supported.
We will need manual interaction to bring up/down the VTI interface upon tunnel failover.

Check Point R77.20.xx for 600 / 700 / 1100 / 1200R / 1400 / 910 Appliance Features and Known Limitat...
>> SMB-2668 - When a VPN tunnel goes down, routes that use the associated VTI as a target (next hop) remain active. Therefore, you cannot use metric-based failover between routes to different VTIs. 

Same goes for 1500/1600/1800 series.

[CheckCheckM]

Thanks for the great suggestion! @Tom_Hinoue  i'm using r81.10.05 but still limitation as known regarding VPN Service based link selection. Hopefully in next firmware.