VPN between Cisco and Check Point with ISP redundancy

[simone-mantovani]

Hello Everyone

this is my first post; I need some suggestions; in the next days I'll configure a VPN  between a Cisco ASA firewall and a Check Point Firewall (SMB device).

The ASA has only one WAN, while the Check Point has 2 WANs; the VPN will be configured as a route-based VPN defining numbered VTIs for each tunnel.

On ASA side Is there any specific configuration to pay attention to? I think, for example, posible issue for peer ID, because the VPNs will be two but the Check Point is only, so it will be seen by the ASA always as the same firewall.

Thanks in advance.

[Rob Ingram]

@simone-mantovani from the ASA's perspective it should be straight forward, it will peer with two unique IP addresses on the Check Point using the ASA's outside interface IP address as the local identity as default. With the VPN established you can then run a routing protocol and either load balance over both tunnels or set a preference on one tunnel and run active/standby.

[simone-mantovani]

Hello Rob

sound interesting, at the moment we'll use static routing,is there a particular configuration to be implemented on ASA to have active- standby tunnels?

Thanks.

[Rob Ingram]

@simone-mantovani if you use static routes, you would need to use IP SLA to track something on the remote end of the VPN. You'd need to setup the other end to track something on the ASA side. It's more practical to use dynamic routing protocol over the VPN.

[Aref Alsouqi]

Please take a look at this post of mine, it should give you what you need to track the tunnels and switch between them based on their status, and also preempt to the primary when it comes back.

ASA site-to-site VPN failover workaround | Blue Network Security