Check Point - ISDN VPN and Serial VPN to same LAN

Posted on 2003-02-25
Medium Priority
Last Modified: 2013-11-16
      LAN A
Check Point Firewall
   |           |
Serial       ISDN
   |           |
    \         /
     \       /
       LAN B

OK...  I want a VPN tunnel going from LAN A to LAN B, through the Serial link, and I want a backup VPN tunnel going from LAN A to LAN B, through the ISDN link.
The trouble is, I can't see how you cann prioritise either the Serial or ISDN router on Check Point - it will just use the Serial and ISDN links in turn..
Anybody else set this up ?
Question by:Tim Holman
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Expert Comment

ID: 8018748

I've done something very similar to this in the past: primary channel over Frame Relay with a DoD backup on ISDN.  We used Nokia boxes, and had the added complication that there were HA pairs at each end each also running VRRP.  Messy...

Anyway, the way we went about it was to let the base OS (IPSO in our case) handle routing.  In CheckPoint, the gateway on LAN A only cares about the peer IP address of its IPSec peer on LAN B.  The actual IPSec (and IKE) packets are routed by the base OS.

So, you can configure two routes in the base OS.  Set the ISDN route to have a higher cost than the serial and hey - it works!  This assumes that CheckPoint has one interface to a LAN with both Serial and ISDN gateways.

If there are actually 2 interfaces in CheckPoint, you could configure a dynamic routing protocol (such as RIP), and just cost the ISDN interface higher than the serial.  In this case, you will have to have interface spoofing on the ISDN otherwise the routing protocol will see it as down all the time.  When one goes down, the route for it should be available through the other.

If this doesn't help, then can you post some more details - specifically what version of CP on what platform, and more details on the connections between CP and the WAN interfaces?

Have fun!


Accepted Solution

velimirmkd earned 400 total points
ID: 8023188

Acctually there is one very simple trick you can do in this kind of situation.  
I assume that you are using some sort of router with serial and ISDN interface.  Well if it is Cisco, (and this feature is supported by some other vendors as well), defince a loopback interface on the router.  On the FW define that the peer or encription for LAN a will  be the IP address of the loopback interface of the router.  This way no matter if the connection is through the serial or ISDN, you will still have the same peer of encription for LAN A, being able to retain the sessions even when the serial is down and the ISDN is up and opposite.  If able to do this on both sides LAN A, and LAN B, then you have no problem, you are rolling.

Hope this helps
LVL 23

Author Comment

by:Tim Holman
ID: 8024026
Thanks Velimir - I will set this up - a few others have suggested this too, so we must be on the right track... :)

Featured Post

On Demand Webinar: Networking for the Cloud Era

Ready to improve network connectivity? Watch this webinar to learn how SD-WANs and a one-click instant connect tool can boost provisions, deployment, and management of your cloud connection.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Wikipedia defines 'Script Kiddies' in this informal way: "In hacker culture, a script kiddie, occasionally script bunny, skiddie, script kitty, script-running juvenile (SRJ), or similar, is a derogatory term used to describe those who use scripts or…
If you are like regular user of computer nowadays, a good bet that your home computer is on right now, all exposed to world of Internet to be exploited by somebody you do not know and you never will. Internet security issues has been getting worse d…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …
Suggested Courses
Course of the Month11 days, 20 hours left to enroll

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question