CP s2s vpn to Azure VPN Gateway (Active-Active)

[H4ppyM3]

Hi ALL,

Did someone build a VPN between on-prem Checkpoint ClusterXL ( act-stb ) and Azure VPN Gateway ( act-act ) ? If so, which type – route or policy based ? As referring https://support.checkpoint.com/results/sk/sk101275 preferred way is policy-based.

If Azure is act-act it will have 2 different public IP’s. How to build the encryption domain if the network behind azure is same for both remote-peers. ( NAT ? )

[Alex- · Accepted solution]

In this setup it is probably preferable to go for two route-based VPN with BGP.

sk176249 discusses this for Azure VWAN and CloudGuard instances, but the Azure VPN Gateway follows mostly the same pattern.

We have successfully configured two redundant VPN gateways to Azure with BGP using this approach.

[H4ppyM3]

this sounds like a very good option. 

Thank you !!