VPN Tunnel between ClusterXL and AWS

[gm446]

Hi everyone,

I have a basic question about establishing Site to Site between Checkpoint cluster and AWS VPC.

Until now, the deployment was a single gateway and i have two tunnels with numbered VTI according to AWS guide. We've recently switched to ClusterXL deployment, and I'm unsure about how to adjust the tunnel configurations to ensure functionality after a fail over.

Should i remove one VTI from the primary and set it on the secondary? should i configure both VTIs in both gateways with other IP addresses and make the VTI address the VIP?

i will appreciate any help with this subject.

Thank you in advance,
Yossi.

[emmap]

You should configure both VTIs on both cluster members, with tunnel IP per member and a VIP. Details are in the VPN admin guide.

[gm446]

Thank you!