Configuring Active-Standby BGP for Site-to-Site Through SASE (Quantum and Maestro)

This procedure explains when and how to configure active-standby BGP for site-to-site traffic through redundant VTI tunnels with SASE and Maestro deployments. It also describes prerequisites and primary-region selection considerations.

When to Use This

Use this procedure for site-to-site traffic that transits Check Point SASE over two redundant route-based Virtual Tunnel Interface (VTI) tunnels when the site cannot guarantee that it returns each response on the same tunnel on which it received the request.

In this case, both directions must be pinned to a single tunnel in an active-standby configuration. Otherwise, responses can reach a different SASE Gateway from the Gateway that handled the request and be dropped.

Agent-to-site traffic in either direction is not affected and can use either mode.

This procedure applies to Quantum single gateways, Quantum clusters, and Maestro. VSX runs routing in a virtual-system context and uses different tunnel-creation commands. The same principles apply, but adapt the commands to the VSX virtual-system context.

Before You Start

This procedure continues from the redundant-tunnel Administration Guide procedure after the VPN tunnel interfaces are created. This procedure covers only the active-standby BGP configuration.

  • If the VTIs are already created through the Gaia Portal, as described on the Administration Guide page, continue to BGP Configuration in Gaia Clish.

  • If the VTIs are not created, create the two numbered VTIs first. Return to the tunnel-interface step on your platform's Administration Guide page, or create the VTIs in Gaia Clish.

Run:

add vpn tunnel 1 type numbered local <PRIMARY_VTI_LOCAL_IP>   remote <PRIMARY_PEER_VTI_IP>   peer <PRIMARY_INTEROP_NAME>
                add vpn tunnel 2 type numbered local <SECONDARY_VTI_LOCAL_IP> remote <SECONDARY_PEER_VTI_IP> peer <SECONDARY_INTEROP_NAME>

On a cluster, create the tunnels on both members. Each member uses its own local VTI IP address. In SmartConsole, set the VIP on the tunnel interfaces with Get Interfaces Without Topology. Then continue with the BGP configuration.

Choose the Primary Region

Decide which of the two SASE regions is the primary active path. The other region becomes the secondary standby path.

There is no product-preferred primary region. Choose the primary region based on your routing policy.

In the commands:

  • <PRIMARY_PEER_VTI_IP> is the VTI remote address of the primary region's SASE Gateway.

  • <SECONDARY_PEER_VTI_IP> is the VTI remote address of the secondary region's SASE Gateway.

Configure the active-standby BGP settings for the redundant VTI tunnels according to your routing policy and selected primary region.