Redundant VPN Tunnel

[GabsOliv]

Hi

On Main site, will have an appliance with two internet connection (two ISP’s), with fixed IP. One Remote sites, (one internet connection with fixed IP), I need to establish a VPN to the main site.

Target is established to one of the ISP’s, if it fails, automatically the tunnel will be established to the other.

We only can do this, using VTI, correct? or is there any other option?

Thanks

[Pedro_Espindola]

Actually, in the VPN site configuration, you can set it to HA. You don't need VTIs. Works very well between 2 SMB appliances.

Are all the sites Check Point appliances?

[GabsOliv]

Hi

All the sites will be checkpoint SMB appliances, but without HA. 

[G_W_Albrecht · Accepted solution]

So you plan using ISP Load Sharing ? As you wrote, without HA...

[GabsOliv]

Hi

My plan is use ISP Load Sharing on the main site. Remote site's will connect to Main, using vpn. The S2S VPN will be established to Interface in ISP1. If ISP1 fails, need to establish S2S VPN to ISP2.

As far as i can see, the only way to do it is using VTI tunnels. Any other idea ?

[G_W_Albrecht]

No other idea.

[Pedro_Espindola]

"If ISP1 fails, need to establish S2S VPN to ISP2"

That is High Availability. You can use it domain based, no need to use VTIs. Here is what you have to do in the remote sites:

[Ricardo_Gros]

Hi Pedro, 

Have you tried this with the main Site being on Load Sharing? 

I´m wondering if this wont create confusion if the Tunnel is initiated from the Central Gateway. 

[Pedro_Espindola]

He can also use the Load Sharing option.

Or he can set the option "only remote site initiates the connection" when configuring the site in the Main Gateway.

[GabsOliv]

[Ricardo_Gros]

Hi Gabriel, 

From the design it seems you want to have 2 Permanent tunnels as redundancy and not have 1 tunnel establish on active Link.  I don´t think you can do this over ISP load sharing (but never tried) and the 2 option seems simpler. 

For your design I think you need Route based VPN.

[Pedro_Espindola]

I had issues trying to use VTIs for redundancy. It works well on NON-SMB appliances, but how do I set the route as monitored in the little ones?

When Tunnel goes down, the primary route remains UP and we get no traffic.

Then I found out about the HA option, gave up on VTIs and had no more problems for SMB to SMB tunnels.

[Ricardo_Gros]

Hi, 

When we did this we used Dynamic routing, so the routes where not advertised if one of the links was down. 

At the time I did not find a way to have something like ping probing. However eventually if you route to the VTI interface directly (not the IP but the VTI ID can be selected) it removes the route? To be honest never tried this with static routes. 

[Pedro_Espindola]

No, the route remains active no matter what happens. I guess only dynamic routing will work, as you said.

[Chris_Atkinson]

Correct, please refer known limitation: SMB-2668