https://community.checkpoint.com/t5/General-Topics/Site-to-Site-VPN-with-one-public-IP/m-p/129106#M23545 <P>Hi Guys,</P><P>My company has three branch offices in different locations. We have Checkpoint Firewall at our main office. I wanted to create a site-to-site VPN between my main branch and one other location. My main branch has a Public IP but my other branch doesn't. Someone told me that we can create site to site VPN tunnel with one public IP and one dynamic IP too. I am not too sure, so anyone can please confirm whether this is possible? Thank you a lot in advance.</P> Fri, 10 Sep 2021 11:43:51 GMT Satyam1 2021-09-10T11:43:51Z https://community.checkpoint.com/t5/General-Topics/Site-to-Site-VPN-with-one-public-IP/m-p/129106#M23545 <P>Hi Guys,</P><P>My company has three branch offices in different locations. We have Checkpoint Firewall at our main office. I wanted to create a site-to-site VPN between my main branch and one other location. My main branch has a Public IP but my other branch doesn't. Someone told me that we can create site to site VPN tunnel with one public IP and one dynamic IP too. I am not too sure, so anyone can please confirm whether this is possible? Thank you a lot in advance.</P> Fri, 10 Sep 2021 11:43:51 GMT https://community.checkpoint.com/t5/General-Topics/Site-to-Site-VPN-with-one-public-IP/m-p/129106#M23545 Satyam1 2021-09-10T11:43:51Z https://community.checkpoint.com/t5/General-Topics/Site-to-Site-VPN-with-one-public-IP/m-p/129117#M23546 <P>What kind of gateway is at the remote site?<BR />In general, this can be done, but:</P> <UL> <LI>VPN must be authenticated with certificates (not supported with PSK)</LI> <LI>Remote end is defined as Dynamic IP (in the relevant gateway object)</LI> </UL> Fri, 10 Sep 2021 15:28:00 GMT https://community.checkpoint.com/t5/General-Topics/Site-to-Site-VPN-with-one-public-IP/m-p/129117#M23546 PhoneBoy 2021-09-10T15:28:00Z https://community.checkpoint.com/t5/General-Topics/Site-to-Site-VPN-with-one-public-IP/m-p/129122#M23547 <P>Phoneboy gave you answer that exactly describes what you need to do. Sadly, this would never ever work with pre shared key, so you definitely must use the cert. And if Im not mistaken, though phoneboy can correct me, when you create interoperable object, yes, you define it as DAIP, but I believe you also must define the certificate authority there as well.</P> Fri, 10 Sep 2021 16:47:58 GMT https://community.checkpoint.com/t5/General-Topics/Site-to-Site-VPN-with-one-public-IP/m-p/129122#M23547 the_rock 2021-09-10T16:47:58Z https://community.checkpoint.com/t5/General-Topics/Site-to-Site-VPN-with-one-public-IP/m-p/129142#M23560 <P>That’s part of the VPN Community definition, I believe.</P> Fri, 10 Sep 2021 18:42:04 GMT https://community.checkpoint.com/t5/General-Topics/Site-to-Site-VPN-with-one-public-IP/m-p/129142#M23560 PhoneBoy 2021-09-10T18:42:04Z