IPSec VPN Load Sharing

[nycc3883]

Hi All,

I would like to achieve IPSec VPN Tunnel Load Sharing (Active Active) with the scenario below:

Site A - With 2 Static IP, each with 100Mbps (HQ)

Site B - with 1 Static IP, with 10Mbps (Branch)

There are 50 Branch with Site B environment to connect to Site A.

My question would be

1. Does CheckPoint Load Sharing Active Active can be done in this way?

2. Does it combine Site A both bandwidth as one?

[Maarten_Sjouw]

I think it is important to know what you mean by the "Load Sharing Active Active", does that mean a Cluster in this mode or are you looking for a way to share the load over the 2 internet connections?
For the latter your best bet would be to use Policy Based Routing on the gateway to make sure that a number of tunnels is using the second interface.
You need to add those routes for the remote peers in your gateway and look yourself at the load.
But I think it would be a better way to just use the primary interface for all normal traffic and use the second interface for all tunnels.
That would still be best done with policy based routing as when the second interface fails it will fallback to the primary.

[nycc3883]

I was referring to IPSec VPN Tunnel Load Sharing as Active Acitive

[Maarten_Sjouw]

There is no load sharing for VPN, the link selection will allow you to select 1 interface only, also make sure to update the source selection when you do make changes like I mentioned in my previous reply.

[Wolfgang]

@nycc3883  and @Maarten_Sjouw 

you can define VPN LoadSharing via LinkSelection properties

We are using this with GAiA gateways and the VPN traffic will be distributed beetween both links. I know there are some limitations with SMB devices but don't remember.

Have look at Site to Site VPN R80.30 Administration Guide and search for "load sharing"

Wolfgang

[Maarten_Sjouw]

So you learn something every day. Thanks @Wolfgang