Multiple Entry Point (MEP) VPNs

In This Section: Overview of MEP Explicit MEP Implicit MEP Routing Return Packets Special Considerations Configuring MEP

Overview of MEP

Multiple Entry Point (MEP) is a feature that provides a High Availability and Load Sharing solution for VPN connections. A Security Gateway on which the VPN module is installed provides a single point of entry to the internal network. It is the Security Gateway that makes the internal network "available" to remote machines. If a Security Gateway should become unavailable, the internal network too, is no longer available. A MEP environment has two or more Security Gateways both protecting and enabling access to the same VPN domain, providing peer Security Gateways with uninterrupted access.

VPN High Availability Using MEP or Clustering

Both MEP and Clustering are ways of achieving High Availability and Load Sharing. However:

• Unlike the members of a ClusterXL Security Gateway Cluster, there is no physical restriction on the location of MEP Security Gateways. MEP Security Gateways can be geographically separated machines. In a cluster, the clustered Security Gateways need to be in the same location, directly connected via a sync interface.
• MEP Security Gateways can be managed by different Security Management Server; cluster members must be managed by the same Security Management Server.
• In a MEP configuration there is no "state synchronization" between the MEP Security Gateways. In a cluster, all of the Security Gateways hold the "state" of all the connections to the internal network. If one of the Security Gateways fails, the connection passes seamlessly over (performs failover) to another Security Gateway, and the connection continues. In a MEP configuration, if a Security Gateway fails, the current connection is lost and one of the backup Security Gateways picks up the next connection.
• In a MEP environment, the decision which Security Gateway to use is taken on the remote side; in a cluster, the decision is taken on the Security Gateway side.

Implementation

MEP is implemented via a proprietary Probing Protocol (PP) that sends special UDP RDP packets to port 259 to discover whether an IP is reachable. This protocol is proprietary to Check Point and does not conform to RDP as specified in RFC 908/1151.

Note - These UDP RDP packets are not encrypted, and only test the availability of a peer.

The peer continuously probes or polls all MEP Security Gateways in order to discover which of the Security Gateways are "up", and chooses a Security Gateway according to the configured selection mechanism. Since RDP packets are constantly being sent, the status of all Security Gateways is known and updated when changes occur. As a result, all Security Gateways that are "up" are known.

There are two available methods to implement MEP:

MEP Method	Description
Explicit MEP	Only Star communities with more than one central Security Gateway can enable explicit MEP. This MEP method provides multiple entry points to the network behind the Security Gateways. When available, Explicit MEP is the recommended method.
Implicit MEP	This MEP method is supported in all scenarios, where fully or partially overlapping encryption domains exist, or where Primary-Backup Security Gateways are configured.

Explicit MEP

In a Site To Site Star VPN community, explicit MEP is configured in the VPN community object. When MEP is enabled, the satellites consider the "unified" VPN domain of all the Security Gateways as the VPN domain for each Security Gateway. This unified VPN domain is considered the VPN domain of each Security Gateway:

In the figure, a Star VPN community has two central Security Gateways, M1 and M2 (for which MEP has been enabled) and three satellite Security Gateways - S1, S2, and S3. When S2 opens a connection with Host-1 (which is behind M1 and M2), the session will be initiated through either M1 or M2. Priority amongst the MEP Security Gateways is determined by the MEP entry point selection mechanism.

If M2 is the selected entry point and becomes unavailable, the connection to Host-1 fails over to M1. Returning packets will be rerouted with RIM or IP Pool NAT. For more information about returning packets, see Routing Return Packets.

There are four methods used to choose which of the Security Gateways will be used as the entry point for any given connection:

Method	Description
Select the closest Security Gateway to source	First to respond
Select the closest Security Gateway to destination	By VPN domain
Random selection	For Load distribution
Manually set priority list	MEP rules

If you select either By VPN domain , or Manually set priority list, then Advanced options provide additional granularity.

MEP Selection Methods

MEP Selection Method	Description
First to Respond	The first Security Gateway to reply to the peer Security Gateway is chosen. An organization would choose this option if, for example, the organization has two Security Gateways in a MEP configuration - one in London, the other in New York. It makes sense for VPN peers located in England to try the London Security Gateway first and the NY Security Gateway second. Being geographically closer to the peers in England, the London Security Gateway will be the first to respond, and becomes the entry point to the internal network. See: First to Respond.
VPN Domain	If the destination IP address belongs to a particular VPN domain, the Security Gateway of that domain becomes the chosen entry point. This Security Gateway becomes the Primary Security Gateway, while other Security Gateways in the MEP configuration become its Backup Security Gateways. See: By VPN Domain.
Random Selection	The remote peer randomly selects a Security Gateway, with which to open a VPN connection. For each source/destination IP address pair, a new Security Gateway is randomly selected. An organization might have a number of Security Gateways with equal performance abilities. In this case, it makes sense to enable load distribution to use these Security Gateways in a random and equal way. See: Random Selection.
Manually set priority list	Priorities of Security Gateways can be set manually for the entire VPN community, or for individual satellite Security Gateways. See: Manually Set Priority List.

First to Respond

When there is no primary Security Gateway, all Security Gateways share "equal priority".

When all Security Gateways share equal priority:

1. Remote peers send RDP packets to all the Security Gateways in the MEP configuration.
2. The first Security Gateway to respond to the probing RDP packets gets chosen as the entry point to network.

   The idea behind first to respond is proximity. The Security Gateway, which is "closer" to the remote peer, responds first.

3. A VPN tunnel is opened with the first to respond. All subsequent connections pass through the chosen Security Gateway.
4. If the Security Gateway ceases to respond, a new Security Gateway is chosen.

By VPN Domain

Before you enable MEP, each IP address belongs to a specific VPN domain. With By VPN Domain, the Security Gateway of that domain becomes the chosen entry point.

In the example figure below, the VPN Star community has two central MEP Security Gateways (M1 and M2, each of which have their own VPN domains), and remote satellite S1.

Host-2 (in the VPN domain of satellite S1 initiates a connection with Host-1. The connection can be directed through either M1 or M2. However, Host-1 is within M2's original VPN domain. For this reason, M2 is considered the Security Gateway "closest" to the destination IP address. M2 is therefore considered the primary Security Gateway and M1 the backup Security Gateway for Host-1. If there were additional Security Gateways in the center, these Security Gateways would also be considered as backup Security Gateways for M2.

If the VPN domains have fully or partially overlapping encryption domains, then more than one Security Gateway will be chosen as the "closest" entry point to the network. As a result, more than one Security Gateway will be considered as "primary." When there are more than one primary or backup Security Gateways available, the Security Gateway is selected with an additional selection mechanism. This advanced selection mechanism can be either (See Advanced Settings):

• First to Respond
• Random Selection (for load distribution)

For return packets you can use RIM on the center Security Gateways. If RIM is also enabled, set a metric with a lower priority value for the leased line than the VPN tunnel. The satellite S1 might simultaneously have more than one VPN tunnel open with the MEP Security Gateways, for example M2 as the chosen entry point for Host-1 and M1 as the chosen entry point for Host-3. While both M1 and M2 will publish routes to Host-1 and Host-3, the lower priority metric will ensure the leased line is used only when one of the Security Gateways goes down.

Random Selection

With this method, a different Security Gateway is randomly selected as an entry point for incoming traffic. Evenly distributing the incoming traffic through all the available Security Gateways can help prevent one Security Gateway from becoming overwhelmed with too much incoming traffic.

The Security Gateways are probed with RDP packets, as in all other MEP configurations, to create a list of responding Security Gateways. A Security Gateway is randomly chosen from the list of responding Security Gateways. If a Security Gateway stops responding, another Security Gateway is (randomly) chosen.

A new Security Gateway is randomly selected for every source/destination IP addresses pair. While the source and destination IP addresses remain the same, the connection continues through the chosen Security Gateway.

In such a configuration, RIM is not supported. IP Pool NAT must be enabled to ensure return packets are correctly routed through the chosen Security Gateway.

Manually Set Priority List

The Security Gateway that will be chosen (from the central Security Gateways in the Star VPN community) as the entry point to the core network can be controlled by manually setting a priority per source Security Gateway.

Each priority constitutes a MEP Rule.

In the figure below, three MEP members (M1, M2, M3) provide entry points to the network for three satellite Security Gateways (S1, S2, S3). Satellite S1 can be configured to try the Security Gateways in the following order: M1, M2, M3, giving the highest priority to M1, and the lowest priority to M3. Satellite S2 can be configured to try the Security Gateways in the following order: M2, M3 (but not to try M1).

Each of these priorities constitutes a MEP rule in the MEP manual priority list window:

Item	Description
1	Default MEP Rule
2	First MEP Rule
3	Second MEP Rule

The MEP manual priority list window is divided into the default rule, and rules which provide exceptions to the default rule. The default MEP rule takes effect when:

• No MEP rules are defined
• When the source of the connection cannot be found in the Exception priority rules

The Exception priority rules section contains three priority levels: primary, secondary, and tertiary. While there are only three priority levels,

• The same priority can be assigned to several central Security Gateways
• The same rule can be assigned to several satellite Security Gateways
• A priority level can be left blank

In the second MEP rule below:

Central Security Gateways M3 and M1 have equal priority. The same rule is being applied to satellites S2 and S3.

When more than one Security Gateway is assigned the same priority level, which Security Gateway will be chosen is resolved according to the Advanced settings. See Advanced Settings.

Advanced Settings

In some instances, more than one Security Gateway is available in the center with no obvious priority between them. For example - as shown in the second example of the second MEP rule, above - more than one Security Gateway is assigned "second" priority. In this scenario, Advanced options are used to decide which Security Gateway is chosen: First to Respond, or Random Selection. (Choose Random Selection to enable load balancing between the Security Gateways.)

When "manually set priority list" is the MEP selection mechanism, RIM is supported. RIM can be configured with "manually set priority list" because the "random selection" mechanism available on the Advanced button is different from the random selection mechanism used for MEP.

For the "random selection" mechanism employed for MEP, a different Security Gateway is selected for each source/destination IP addresses pair. For the random selection mechanism available from the Advanced button, a single MEP entry point is randomly selected and then used for all connections, and does not change according to source/destination pair. Load distribution is therefore achieved since every satellite Security Gateway is randomly assigned a Security Gateway as its entry point. This makes it possible to enable RIM at the same time.

Tracking

If the Tracking option is enabled for MEP, this information is logged by each satellite Security Gateway:

• The resolved peer Security Gateway (a Security Gateway in the MEP)
• The priority of the resolved Security Gateway (primary, secondary, tertiary)
• Whether the resolved Security Gateway is responding

For example, in the scenario shown in the Manually Set Priority List section, satellite S1 opens a connection to the VPN domain that includes Security Gateways M1, M2, and M3. M1 is the resolved peer. If tracking is enabled, the log reads:

Resolved peer for tunnel from S1 to the MEP that contains M1, M2, and M3, is: M1 (Primary Security Gateway, responding).

Implicit MEP

There are three methods to implement implicit MEP:

Method	Description
First to Respond	The first Security Gateway to reply to the peer Security Gateway is chosen. An organization would choose this option if, for example, the organization has two Security Gateways in a MEP configuration - one in London, the other in New York. It makes sense for VPN peers located in England to try the London Security Gateway first and the NY Security Gateway second. Being geographically closer to the peers in England, the London Security Gateway will be the first to respond, and becomes the entry point to the internal network. See: First to Respond.
Primary-Backup	One or multiple backup Security Gateways provide "high availability" for a primary Security Gateway. The remote peer is configured to work with the primary Security Gateway, but switches to the backup Security Gateway if the primary goes down. An organization might decide to use this configuration if it has two Security Gateways in a MEP environment, one of which is stronger than the other. It makes sense to configure the stronger Security Gateway as the primary. Or perhaps both Security Gateways are the same in terms of strength of performance, but one has a cheaper or faster connection to the Internet. In this case, the Security Gateway with the better Internet connection should be configured as the primary. See: Primary-Backup Security Gateways.
Load Distribution	The remote peer randomly selects a Security Gateway, with which to open a VPN connection. For each source/destination IP address pair, a new Security Gateway is randomly selected. An organization might have a number of Security Gateways with equal performance abilities. In this case, it makes sense to enable load distribution to use these Security Gateways in a random and equal way. See: Random Selection.

Implicit MEP is supported, if the Security Gateways with overlapping encryption domains are in the same community. If they are located in different communities, only one of the Security Gateways will be used for this encryption domain.

First to Respond

When there is no primary Security Gateway, all Security Gateways share "equal priority".

When all Security Gateways share "equal priority":

• Remote VPN peers send RDP packets to all the Security Gateways in the MEP configuration.
• The first Security Gateway to respond to the probing RDP packets gets chosen as the entry point to network.

  The idea behind first to respond is "proximity". The Security Gateway which is "closer" to the remote VPN peer responds first.

• A VPN tunnel is opened with the first to respond. All subsequent connections pass through the chosen Security Gateway.
• If the Security Gateway ceases to respond, a new Security Gateway is chosen.

In a star VPN community, RDP packets are sent to the Security Gateways and the first to respond is used for routing only when:

1. There is more than one center Security Gateway
2. One of the following VPN routing options was selected:
   • To center and to other satellites through center
   • To center, or through the center to other satellites, to internet and other VPN targets

     This setting is found on the Community Properties > VPN Advanced > VPN Routing page.

In this example scenario:

• MEP is not enabled on the VPN community
• First to respond method is used
• Security Gateway X accesses VPN domain A through Security Gateway A
• Security Gateway X accesses VPN domain B through Security Gateway B
• Security Gateway X accesses VPN domain C through Security Gateway A or B

Primary-Backup Security Gateways

Backup Security Gateways provide redundancy for primary Security Gateways.

The first Security Gateway is configured as the "primary," and the second Security Gateway as the "backup." If the primary Security Gateway fails, for whatever reason, the remote VPN peer detects that the link has gone down and works through the backup Security Gateway. The backup Security Gateway inherits the complete VPN domain of the primary Security Gateway. Failover within an existing connection is not supported; the current connection is lost.

When the primary Security Gateway is restored, new connections go through the primary Security Gateway, while connections that already exist will continue to work through the backup Security Gateway.

Important - When you use the Primary-Backup Security Gateways method, the encryption domains should not overlap.

Load Distribution

To prevent any one Security Gateway from being flooded with connections, the connections can be evenly shared amongst all the Security Gateways to distribute the load. When all Security Gateways share equal priority (no primary) and are MEP to the same VPN domain, it is possible to enable load distribution between the Security Gateways. The Security Gateways are probed with RDP packets, as in all other MEP configurations, to create a list of responding Security Gateways. A Security Gateway is randomly chosen from the list of responding Security Gateways. If a Security Gateways stops responding, a new Security Gateway is (randomly) chosen.

A new Security Gateway is randomly selected for every source/destination IP addresses pair. While the source and destination IP addresses remain the same, the connection continues through the chosen Security Gateway.

Routing Return Packets

To make sure return packets are routed correctly, the MEP Security Gateway can make use of either of these:

• IP Pool NAT (Static NAT)
• Route Injection Mechanism (RIM)

IP Pool NAT

IP Pool NAT is a type of NAT, in which source IP addresses from remote VPN domains are mapped to an IP address drawing from a pool of registered IP addresses. In order to maintain symmetric sessions with MEP Security Gateways, the MEP Security Gateway performs NAT with a range of IP addresses dedicated to that specific Security Gateway and should be routed within the internal network to the originating Security Gateway. When the returning packets reach the Security Gateway, the Security Gateway restores the original source IP address and forwards the packets to the source.

Route Injection Mechanism

Route Injection Mechanism (RIM) enables a Security Gateway to use a dynamic routing protocol to propagate the encryption domain of a VPN peer Security Gateway to the internal network. When a VPN tunnel is created, RIM updates the local routing table of the Security Gateway to include the encryption domain of the VPN peer.

When a tunnel to a MEP Security Gateway goes down, the Security Gateway removes the applicable "return route" from its own local routing table. This change is then distributed backwards to the routers behind the Security Gateway.

RIM is based both on the ability of the Security Gateway to update its local routing table, and the presence of the a dynamic routing protocol to distribute the change to the network behind the Security Gateway. There is little sense in enabling RIM on the Security Gateway if a dynamic routing protocol is not available to distribute changes.

When MEP is enabled, RIM can be enabled only if permanent tunnels are enabled for the whole community. In a MEP configuration RIM is available when you use the First to Respond, Manual set priority list, and VPN Domain mechanisms. In the first two options, satellite Security Gateways "see" the center Security Gateways as unified as if one tunnel is connecting them. As a result, only the chosen MEP Security Gateway will inject the routes. In VPN Domain MEP, it could be that all MEP Security Gateways will inject the routes, which requires configuring the routers behind the MEP Security Gateways to return packets to the correct Security Gateway.

RIM is not available when Random Selection is the selected entry point mechanism.

For more information, see Route Injection Mechanism.

Special Considerations

1. If one of the central Security Gateways is an externally managed Security Gateway:
   • The VPN domain of the central Security Gateways will not be automatically inherited by an externally managed Security Gateway
   • The RIM configuration will not be automatically downloaded
2. UTM-1 Edge devices cannot be configured as a MEP Security Gateway, but can connect to MEP Security Gateways.
3. DAIP Security Gateways require DNS resolving in order to be configured as MEP Security Gateways.

Configuring MEP

To configure MEP, decide on:

1. The MEP method:
   • Explicit MEP (see Explicit MEP).
   • Implicit MEP (see Implicit MEP).
2. If required, method for returning reply packets:
   • IP Pool NAT
   • Route Injection Mechanism (see Configuring RIM).

Configuring Explicit MEP

Explicit MEP is only available in Site-to-Site Star VPN communities where multiple central Security Gateways are defined.

To configure MEP:

1. In SmartConsole, click Objects menu > Object Explorer.
2. From the left tree, select VPN Communities.
3. Open the Star VPN Community object.
4. From the left tree, click MEP.
5. Select Enable center gateways as MEP.
6. Select the applicable entry point mechanism:
   • First to respond
   • By VPN domain
   • Random selection
   • Manual priority list

   Notes:

   • If you select By VPN domain or Manually set priority list, then in the Advanced section choose First to respond or Random selection to resolve how more than one Security Gateway with equal priority should be selected.
   • If you select Manually set priority list, then click Set to create a series of MEP rules.
7. Select a Tracking option, if required.
8. Click OK.
9. Install the Access Control Policy.

Configuring Implicit MEP

Configuring Implicit First to Respond

When more than one Security Gateway leads to the same (overlapping) VPN domain, they are in a MEP configuration. The first Security Gateway to respond is chosen. To configure first to respond, define that part of the network that is shared by all the Security Gateways into a single group and assign that group as the VPN domain.

Before you start, make sure that Load Distribution for MEPs configurations is disabled:

1. In SmartConsole, click Menu > Global properties > VPN > Advanced.
2. Clear the Enable load distribution for Multiple Entry Points configurations (Site to Site connections).
3. Click OK.

To configure First to Respond MEP:

1. On each Security Gateway in the VPN domain, run this command:

   vpn overlap_encdom

2. In SmartConsole, create a Network Group object and assign all these Security Gateways to it.
3. In each Security Gateway object:
4. Click Network Management > VPN Domain.
5. Select Manually defined.
6. Click the [...] button.
7. Select the Network Group object of MEP gateways that you defined in Step 2.
8. Click OK.
9. Install the Access Control Policy on all these Security Gateways.

Configuring Implicit Primary-Backup

Configure the VPN Domain that includes the Primary Security Gateway and another VPN Domain that includes only the Backup Security Gateways.

Configure each Security Gateway as either the Primary Security Gateway, or a Backup Security Gateway.

Procedure:

Step	Description
1	Enable the Backup Gateway options in Global properties: Click Menu > Global properties > VPN > Advanced. Select Enable Backup Gateway. Click OK to close the Global properties window.
2	Configure a Network Group object: Click Objects menu > Object Explorer. At the top, click New > Network Group. Configure this Network Group object to contain only Backup Security Gateways. Click OK to close the Network Group object window.
3	Configure the Primary Security Gateway object: Click Objects menu > Object Explorer. From the left tree, select Network Objects > Gateways & Servers. Open the Primary Security Gateway object. Click IPsec VPN. Select Use Backup Gateways. In the drop-down menu, select the Network Group object that contains the Backup Security Gateways. Click OK to close the Primary Security Gateway object. This Security Gateway is now the Primary Security Gateway for this VPN domain.
4	Define the VPN for the Backup Security Gateways. Backup Security Gateways do not always have a VPN Domain of their own. They simply back up the Primary Security Gateway.
	If the Backup Security Gateway does not have a VPN Domain of its own, the VPN Domain should include only the Backup Security Gateway itself: Click Objects menu > Object Explorer. From the left tree, select Network Objects > Gateways & Servers. Open the Backup Security Gateway object. Click Network Management > VPN Domain. Select Manually defined. Click the [...] button. Select the Network Group object that contains only the Backup Security Gateways. Click OK to close the Backup Security Gateway object. Install the Access Control Policy on the Backup Security Gateways.
	If the Backup Security Gateway has a VPN Domain of its own: Click Objects menu > Object Explorer. From the left tree, select Network Objects > Gateways & Servers. Open the Backup Security Gateway object. Click Network Management > VPN Domain. Make sure that the IP address of the Backup Security Gateway is not included in the VPN Domain of the Primary Security Gateway. For each Backup Security Gateway, define a VPN Domain that does not overlap with the VPN Domain of other Backup Security Gateways. Click OK to close the Backup Security Gateway object. Install the Access Control Policy on the Backup Security Gateways. Important - There must be no overlap between the VPN Domain of the Primary Security Gateway and the VPN Domain of the Backup Security Gateways - no IP address can belong to both VPN Domains.

Configuring Implicit Load Distribution

To configure implicit MEP for random gateway selection in SmartConsole:

Step	Description
1	Enable load distribution for MEP configurations: Click Menu > Global properties. From the left tree, click VPN > Advanced. Select Enable load distribution for Multiple Entry Point configurations (Site to Site connections). Click OK to close the Global properties window.
	Configure a Network Group object: Click Objects menu > Object Explorer. At the top, click New > Network Group. Configure this Network Group object to contain all the Security Gateways. Click OK to close the Network Group object window.
2	Define the same VPN Domain for all the Security Gateways: Click Objects menu > Object Explorer. From the left tree, select Network Objects > Gateways & Servers. Open each Security Gateway object. Click Network Management > VPN Domain. Select Manually defined. Click the [...] button. Select the Network Group object that contains all the Security Gateways. Click OK to close the Security Gateway object.
3	Install the Access Control Policy on all the Security Gateways.

Configuring IP Pool NAT

To configure IP Pool NAT for Site to Site VPN in SmartConsole:

Step	Description
1	Enable IP Pool NAT in the Global Properties: Click Menu > Global properties. Click NAT - Network Address Translation. Select Enable IP Pool NAT. Select the applicable options (None, Log, or Alert) for: Address exhaustion track Address allocation and release track Click OK to close the Global properties window.
2	For each Security Gateway, configure an object that represents the IP Pool NAT addresses for that Security Gateway: Click Objects menu > Object Explorer. The object that represents the IP Pool NAT addresses can be one of these objects: Network - At the top, click New > Network Network Group - At the top, click New > Network Group Address Range - At the top, click New > Network Object > Address Range > Address Range. Configure this object to contain the applicable IP addresses. Click OK to close the object with IP Pool NAT addresses.
3	In each Security Gateway, configure IP Pool NAT settings: Click Objects menu > Object Explorer. From the left tree, select Network Objects > Gateways & Servers. Open each Security Gateway object. Click NAT > IP Pool NAT. Select one of these two options: Allocate IP Addresses from. If you choose this option, then select the object that represents the IP Pool NAT addresses for that Security Gateway. Define IP Pool addresses on Gateway interfaces. If you choose this option, then you must configure the IP Pool NAT on each required interface: (i) From the left tree, click Network Management. (ii) Edit each required interface. (iii) From the left tree, click General. (iv) In the Topology section, click Modify. (v) In the IP Pool NAT section, select the object that represents the IP Pool NAT addresses. (vi) Click OK. Select the applicable options: Use IP Pool NAT for VPN clients connections Use IP Pool NAT for gateway to gateway connections Prefer IP Pool NAT over Hide NAT Click Advanced to configure the advanced IP Pool NAT settings. Click OK. Click OK to close the Security Gateway object.
4	Install the Access Control Policy on all Security Gateways.
5	Edit the routing table for each internal router, so that packets with an IP address assigned from the IP Pool NAT are routed to the applicable Security Gateway.