Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
RLopez
Participant
Jump to solution

VPN Site to Site with differents ISP

Hello,

 

I ask here because the documentation is very confusing about thesetopics, maybe you can help me to pick the right option.

A customer has a cluster with a s2s vpn tunnel, it is configured like a domain vpn, using a public ip conected to a ISP1.

Now he needs to add 2 new tunnels, but using 2 new ISP, each one providing his own public ip to be configured in the gateway.

Which type of vpn scenario would be the right one? (still in this community with link selection, new route based vpns, vti.....)

The 3 remote third party gateways are not Check Point devices.

 

Thanks in advance!

 

 

 

 

 

 

 

0 Kudos
1 Solution

Accepted Solutions
PhoneBoy
Admin
Admin

The only way this can work right now is for each VPN link to route out a different physical interface with the relevant IP address assigned.
This requires Link Selection to be set up accordingly.
Otherwise, it is not possible to use a different IP for a different VPN peer.
Also, if you're mixing route and domain-based VPNs on the same gateway, see: https://support.checkpoint.com/results/sk/sk109340 

Hopefully, with the changes planned for R82, this sort of scenario should be easier to support,. 

View solution in original post

8 Replies
PhoneBoy
Admin
Admin

The only way this can work right now is for each VPN link to route out a different physical interface with the relevant IP address assigned.
This requires Link Selection to be set up accordingly.
Otherwise, it is not possible to use a different IP for a different VPN peer.
Also, if you're mixing route and domain-based VPNs on the same gateway, see: https://support.checkpoint.com/results/sk/sk109340 

Hopefully, with the changes planned for R82, this sort of scenario should be easier to support,. 

RLopez
Participant

So if I understand it, the way to do this keeping the vpn1 with isp1 as domain vpn is to configure the other 2 as routed vpn, using link selection for this gateway as calculate ip based on network topology and 2 static routes for the two remote networks, each one reachable behing vpn tunnel 2 and vpn tunnel 3, right?

0 Kudos
PhoneBoy
Admin
Admin

That sounds about right, yes.

0 Kudos
the_rock
Legend
Legend

Its right in theory, but in reality, different story... : - (

RLopez
Participant

Lol... What do you mean? Did you have problems with this configuration?

0 Kudos
the_rock
Legend
Legend

I dont have problems with it, but its not so easy to make it work, at least from my experience.

MarcosGarcia
Participant

Ok, understood. Thanks.

0 Kudos
CheckPointerXL
Advisor
Advisor
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events