topic Re: Route Based VPN Tunnel on VSX (Virtual System) in Firewall and Security Management

Route Based VPN Tunnel on VSX (Virtual System)

VishnuK — Fri, 10 Oct 2025 11:37:39 GMT

Hi Team,

We want to configure a route-based VPN tunnel. Below are the environment details:

* Local Gateway- checkpoint Virtual System Firewall

* Peer gateways:

Site-A: Third party Firewall

Site-B: Third party Firewall

* Peer Encryption Domain: common (172.16.1.0/24), behind both location's Firewalls.

* Routing on Local Gateway: Static

As peer encryption domain is common (172.16.1.0/24) which is to be access from our side through the IPSec.

We are planning to implement route-based VPN with both the locations, so that if primary tunnel with Site-A goes down then same Sunbnet_172.16.1.0/24 should be accessible through Site-B's tunnels.

We want to use static routing for this route-based VPN setup.

But we are not able to find route minoring option for VTY interface, as in standard environment (without vsx) we can enable next hop monitoring while configure the static route.

So, looking a solution for tunnel failover with static routing

Re: Route Based VPN Tunnel on VSX (Virtual System)

Chris_Atkinson — Fri, 10 Oct 2025 11:55:35 GMT

To my knowledge route based VPNs for VSX are only supported with dynamic routing e.g. BGP.

Re: Route Based VPN Tunnel on VSX (Virtual System)

Lesley — Fri, 10 Oct 2025 11:57:31 GMT

you need dynamic routing for this like bgp

Dynamic Routing: This infrastructure enables dynamic routing protocols (like OSPF or BGP) to exchange routing information directly with a routing daemon on the other end of the tunnel, making it appear as a single hop.

Check also policy based routing, is now also supported on vsx

https://support.checkpoint.com/results/sk/sk167135

Re: Route Based VPN Tunnel on VSX (Virtual System)

VishnuK — Fri, 10 Oct 2025 12:32:48 GMT

1. Does it mean we can't achieve it, using route monitoring with Static routing?

2. PBR can be used into this case for tunnel failover?

Re: Route Based VPN Tunnel on VSX (Virtual System)

Chris_Atkinson — Fri, 10 Oct 2025 12:39:30 GMT

SmartConsole won't allow you to configure it under classic VSX per sk79700.

"Multiple Static Routes with different priorities to the same destination"

Re: Route Based VPN Tunnel on VSX (Virtual System)

Wolfgang — Fri, 10 Oct 2025 12:53:32 GMT

@VishnuK what do you want to achieve? You need redundancy for your VPN ? Why route based VPN?
I believe you can use the domain based VPN with two third party gateways at the remote site. Redundancy via MEP (MultipleEntryPoint) and using DPD (DeadPeerDetection) to probe the remote gateways availability.
https://support.checkpoint.com/results/sk/sk10860 scenario 8

Re: Route Based VPN Tunnel on VSX (Virtual System)

VishnuK — Mon, 13 Oct 2025 09:41:13 GMT

Hi Wolfgang,

Yes, we want we need redundancy for IPSec. MEP is applicable here? I am suspecting that, considering below points:

* We have the control of Local firewall only

* Traffic direction is outbound (Local to 3rd Party)

* Peer Firewalls are not checkpoint.

As per my understanding MEP can be configured only for incoming traffic. Please correct me, if i am wrong.