ClusterXL - VxLAN over redundant IPSec VPN (R81.10 and future release)

[hdas]

Hello Mates,

does someone know if the R81.10 will support redundant IPSec VPN and VxLAN over IPSec?

As far as I know, the R80.40 and R81 do not support multiple link selection for the multiple VPN tunnels (different public subnets).

This is what I want to achieve:

Thanks,

[Benedikt_Weissl]

You could try VPN Link Selection in Load Sharing mode. According to the FAQ here (https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...) it will only create one VPN Tunnel and balance the packets between the different links.

[hdas]

My goal was to find a way to use both internet connections at the same time.

[Benedikt_Weissl]

You can use ISP Redundancy for LAN to WAN Traffic und VPN Load Sharing (https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_SitetoSiteVPN_AdminGuide/htm...) for Site2Site VPN Traffic

[PhoneBoy]

Pretty sure this is not among the features supported, see: https://community.checkpoint.com/t5/Product-Announcements/R81-10-EA-Program-Production/ba-p/110053

Mostly likely this exact configuration is an RFE and I encourage you to bring it through your local Check Point office.

[hdas]

Hi PhoneBoy,

I don't know if the local office will be able to support me on this. We need to look elsewhere, disaggregation maybe? Just think how useful would be to have the control plane (VRF, virtual router..etc) in ClusterXL? 😍

[genisis__]

not sure about this, but could you not just run x2 GRE tunnels through the Checkpoints?