Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
CheckCheckM
Participant

Quantum Spark IPsec tunnel failover

Hello all,

I have a question regarding quantum spark 1800 (R81.10), i have two ipsec between Check point add peer-firewalls with below scenario

QS-Tunnel.png

. But i cannot setup auto failover for both tunnel, swing manual currently. Is there any idea to solve? thanks much, everyone. 

 

 

 

9 Replies
Chris_Atkinson
Employee Employee
Employee

Locally or centrally managed appliance with domain or Route based tunnels?

CCSM R77/R80/ELITE
0 Kudos
CheckCheckM
Participant

locally managed. i did using domain coz route base tunnel does not work. 

0 Kudos
Chris_Atkinson
Employee Employee
Employee

If the encryption domains are the same this will likely be problematic (sk114652). 

Regarding route based, it didn't work in what way we're you using dynamic or static routing?

Else you may need to explore ISP redundancy. 

CCSM R77/R80/ELITE
0 Kudos
CheckCheckM
Participant

Thanks @Chris_Atkinson . I'm using static routing but i think, as my scenario, if possible, i prefer to setup route based coz wan link redundancy for both side.

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Unfortunately static routes won't work with route based VPNs for redundancy - known limitation.

If you need this specifically versus dynamic routing please discuss it further with your local SE as an RFE.

CCSM R77/R80/ELITE
0 Kudos
G_W_Albrecht
Legend Legend
Legend

Redundant VPN Tunnel

CCSE / CCTE / CTPS / CCME / CCSM Elite / SMB Specialist
0 Kudos
CheckCheckM
Participant

Thanks much @G_W_Albrecht . As my scenario, if possible, i prefer to setup route based coz wan link redundancy for both side. can u pls share route based config guide. Is that need to use VTI in router based?

If i used connection type HA with domain base, peer device (non-checkpoint) need to setup 4 tunnels like mesh. that's why, i prefer router based.

0 Kudos
Tom_Hinoue
Advisor
Advisor

Failover (metric based) using VTIs over 2 IPSec tunnels is currently a limitation and not supported.
We will need manual interaction to bring up/down the VTI interface upon tunnel failover.

Check Point R77.20.xx for 600 / 700 / 1100 / 1200R / 1400 / 910 Appliance Features and Known Limitat...
>> SMB-2668 - When a VPN tunnel goes down, routes that use the associated VTI as a target (next hop) remain active. Therefore, you cannot use metric-based failover between routes to different VTIs. 

Same goes for 1500/1600/1800 series.

 

CheckCheckM
Participant

Thanks for the great suggestion! @Tom_Hinoue  i'm using r81.10.05 but still limitation as known regarding VPN Service based link selection. Hopefully in next firmware.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events