topic IPsec VPN termination on Loopback interfaces -R80.40 in Firewall and Security Management

IPsec VPN termination on Loopback interfaces -R80.40

ab — Thu, 15 Oct 2020 06:08:46 GMT

Hi Team,

I am planning to create a loopback interfaces on my HA cluster with same Public IP to terminate the IPsec VPN tunnels. It is required as I am having private IP address on external interface and I don't want to NAT the IP on Internet router.

Questions:

1. Is that setup feasible , Shall I give the same public IP on both the members as loopback interfaces are not a part of cluster.

2. How would I choose the loopback interface IP as an Peer IP under Gateway Cluster properties -> IPsec VPN -> Link Selection I don't see an option to set this IP to be used as VPN peer IP for my third parties.

3. How this loopback interface chooses physical interfaces to route its traffic

Regards

Anshu Bathla

Re: IPsec VPN termination on Loopback interfaces -R80.40

Wolfgang — Thu, 15 Oct 2020 06:38:18 GMT

@ab

1. Is that setup feasible , Shall I give the same public IP on both the members as loopback interfaces are not a part of cluster.

That's not possible for your needs. You have to create a dummy cluster-interface. The members are assigned private IPs and the VIP will be your public IP.

With these configuration you can choose your public IP in all the needed sections in VPN link selection.

Wolfgang

Re: IPsec VPN termination on Loopback interfaces -R80.40

ab — Thu, 15 Oct 2020 07:04:27 GMT

Thanks Wolfgang,

Shall I consider that as of now terminating the IPsec VPN is not at all possible on Loopback interfaces on Checkpoint Firewalls?

Re: IPsec VPN termination on Loopback interfaces -R80.40

PhoneBoy — Sun, 18 Oct 2020 05:32:28 GMT

Just set the Link Selection IP to a static IP which does not have to be associated with a gateway interface at all.

Re: IPsec VPN termination on Loopback interfaces -R80.40

libin — Mon, 26 Oct 2020 08:08:53 GMT

Hi Anshu,

we also have the same requirement, Were u able to make it work with the dummy cluster interface. Please share your feedback

Re: IPsec VPN termination on Loopback interfaces -R80.40

laurent_ragon — Fri, 12 Sep 2025 06:51:05 GMT

HI,

have you any feedback for this configuration? can we finalise the VPN IPSEC on a dummy INterface ?

What doesn't it mean exactly? should I define on GAIA System also an interface with the private IP address then define the public IP addresse on the CLuster Topologie?

Thank you for your reply