S2S VPN failover using route based VPN

[shantilalSuthar]

Hi Guys,

I have a requirement where i need to create two route-based ipsec tunnels between Checkpoint & third party vendor & there are around 500 clients to which i need to create tunnels in active/backup manner.

Kindly suggest how to achieve this.

[Henrik_J]

Hello!

First of all, you'd have to use route-based VPN as you said, instead of a pure policy-based VPN.

So what you do is define two VTI interfaces on the gateway, acting as the logical interfaces for the VPN, and then set up routing based off that, where you also set up which third party gateway it will communicate towards.

If you want to use static routes with IP tracking, or dynamic protocols such as OSPF or BGP is up to you, I would personally recommend dynamic protocol.

See this guide when it comes to the VTIs etc:
https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SitetoSiteVPN_AdminGuide/Topics-VP...

As for the VPN itself, you create a policy based VPN as usual, but leave the VPN domains as empty groups, (since the routing will decide what will traverse over the tunnel).

[shantilalSuthar]

Thanks for your suggestions but here my question is, Is it possible to keep two VPN tunnel active on different ISP ?

As i know we can only select single interface in link selection option of IPsec VPN.

[Henrik_J]

I mean, you could technically route your interoperable device IPs out on different ISPs with definitive /32 routes to their public IPs.

Should be possible.
Then you'd just use the routing in the VTI tunneling to decide which tunnel to use etc.

[shantilalSuthar]

It means link selection does not matter if we use route based VPN to select the outgoing tunnel ? Am i correct ?

[Blason_R]

From checkpoint end nope it is not possible since you can terminate tunnel only on one ISP. While you can create two tunnels with two ISP for remote end.

[shantilalSuthar]

that is what i was trying to tell. Only one tunnel will be UP at a time right ?? Do we need to use ISP redundancy for auto tunnel failover.