Redundancy VPN S2S

[Icaro_IT]

Good morning

I would like a suggestion on how to perform site-to-site VPN redundancy between a checkpoint and fortigate. Both sides have two ISP links, and both must communicate cross-formation in case of failure of the main ISP

Example image attached

[starmen2000]

I am interested in this topic too.

[the_rock]

I will ask one of my colleagues about Fortigate part, but I can tell you this about CP part. Even if you have ISP redundancy enabled, primary isp link failure will NOT automatically guarantee that VPN tunnel will simply continue to work, as Fortigate would never be aware of new IP address.

Andy

[Icaro_IT]

both sides know the IP of both ISP

[the_rock]

If both ends know about the IPs of both links, then I dont see why it would not work, since in that case, if there is ever a failure, 2nd link would be able to establish a tunnel.

Andy

[Icaro_IT]

right, but what is the best way to do this at the checkpoint? based on static route, mode redundancy probe (CP feature), BGP... or just add a start community with two satellites referencing the fortigate side

[the_rock]

There way smarter people than I on this forum, so Im sure they will chime in, but logically, I would say 2 satellites for FGT end. Not sure BGP would really make much difference here, as you are not doing say xpress route/VPN failover with Azure (just an example)

Andy

[CheckPointerXL]

Route based with static route+priority+ping reachability or bgp+ smaller/bigger announcement (for example announce 192.168.0.0/24 for backup link and announce 192.168.0.0/25 and 192.168.0.128/25 for primary link). Other tips for bgp could be MED or AS-PATH-Prepend.

You can configure two communities or one with two FGT satellites.

Make sure ISP redundancy is applied for vpn too