Dear Community, as an ISP we are monitoring our costumer environments throug IPSec tunnels from our datacenter. I don't know why, but two of our Check Point installations are strange - I cannot access the secondary node through IPSec - other sites work well with the same design. One troublemaker runs an old VRRP cluster (R77.30), the other on… Show more
There is no way to do this indeed, as you say the traffic is decrypted on the active node and forwarded to the backup, and dropped there because it is cleartext. You cannot build separate tunnels to the different members.
in 
