topic Re: Configuring a branch cluster behind Starlink with Dynamic Public IP in SD-WAN

Configuring a branch cluster behind Starlink with Dynamic Public IP

mistercinux_ — Tue, 08 Sep 2026 09:28:56 GMT

Hello all,

I have to configure a cluster of checkpoint on a branch office in a different country.

The HQ is a cluster of 3920 appliances connected to internet with Optical Fiber and has a static ipv4 ip address.

The Branch firewall is a cluster of 2550 appliances connected to internet with a starlink.

Management server is connected to the corporate network on HQ site.

Please find a topology diagram attached .

I suppose that with a prioritary engagement on starlink the VPN should come up with a link selection using dynDNS, but I’m not shure of that.

Moreover, How can I manage those gateways with the management server in that situation  ?

I didn’t found a clear answer on the documentation on how to get my cluster reachable / manageable.

Did someone already configured a centraly managed cluster behind a router with dynamic IP on a remote site ?

PhoneBoy — Wed, 09 Sep 2026 14:36:56 GMT

This FAQ might help answer some of these questions: https://support.checkpoint.com/results/sk/sk167473
Note that VPN authentication must be done via certificates when a DAIP is used.

mistercinux_ — Wed, 09 Sep 2026 17:05:47 GMT

Hi PhoneBoy,

Thanks for your help.

I can’t see any mention of checkpoint clusters with DAIP in the documentation.

Moreover, I don’t have the "DAIP" checkbox when configuring a cluster object. My question is about how to manage a checkpoint cluster behind a DAIP.

Still looking for a solution. I’ll update the ticket if I found the information.

Best regards,