IPSEC VPN gateway traffic selection

[Dilev]

Hi,

We are having an issue with a vpn setup where we have a Checkpoint FW with one ISP line connected to it and a remote site (Juniper srx) with 2 ISP lines connected to it. We have 2 Ikev1 IPSEC vpn tunnels between the two sites that coming up(permanent tunnels enabled).
Our issue is that the traffic between the two sites seems to be going through both tunnels at the same time instead of one tunnel being the primary one and the second one acting as a backup/failover in case the primary tunnel goes down for any reason.

What is the mechanism Checkpoint uses to determine which of the two tunnels it is going to send the traffic through and how can we specify it?

[_Val_]

Version fo CP GW?

[Dilev]

Hi Val,

The CP  GW version is R80.10.

[_Val_]

https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_SitetoSiteVPN_AdminGuide/htm...

Look under "Link Selection with non-Check Point Devices" section. 

Which part initiates VPN tunnel, Juniper or CP? If Juniper, you should look there first. 

[Dilev]

Hi,

We've tried the things suggested in the article, but we are still having issues with the traffic selection.

Currently, the traffic from the checkpoint is taking the backup tunnel to our SRX, instead of the primary one. How can we force it to use one tunnel over the other and switch to the second only if the traffic through the first one fails?

[Juan_]

I suggest using VTIs with a routing protcol over it.

What is known as "Route based VPN"

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

Check IPsec VPN admin guide for your version.

Also you can check config guides for AWS or azure as reference.