MEP VPN Gateway: force specific client to connect to backup gateway

[sklotz]

Hi there,
how can I force specific clients to connect to the backup VPN gateway in a MEP Primary/Backup setup?
Or ask the other way round, how is the Checkpoint Mobile Client verifying, if the primary VPN gateway is available.
Can I simply create a FW-rule (or any other similar configuration) to block this "health-check" to "simulate" that the primary VPN gateway is down without affecting all other VPN-clients?
Or is there any detailed documentation available how the dial-in process of the client-VPN is working and which part of the gateway configuration is doing what and in which order?
As of now this is not really transparent for me.
Thank you!

Regards,
Stefan

[_Val_]

Have you already read the relevant admin guide chapter? It explains different mechanisms, modes, and gives you enough details to figure out the rest.

Yes, you can use a third-party FW to drop the client packets sent to the primary GW. However, that will not work if you are trying to do that on the VPN GW itself, since the VPN negotiations are covered by implied rules.