topic Re: Checkpoint IPSEC VPN with 2 different links in General Topics

Checkpoint IPSEC VPN with 2 different links

SriNarasimha005 — Thu, 05 Feb 2026 08:01:41 GMT

Hi There,

I'd like to setup checkpoint IPSEC VPN (Active/Standby) with 2 Cisco routers via 2 different links. Although these are Internal links, we've configured IPSEC for encryption and the interface addresses would be Internal.

I've attached the topology for better visualization.

Can we have IPSEC tunnel from CP to 2 different links? Please let me know.

Re: Checkpoint IPSEC VPN with 2 different links

TurgutKaplanogl — Fri, 06 Feb 2026 22:37:09 GMT

Hello,

What is your GW and Management version?

Thanks

Re: Checkpoint IPSEC VPN with 2 different links

SriNarasimha005 — Thu, 05 Feb 2026 09:27:21 GMT

Hi @TurgutKaplanogl

Thanks for your reply. MDS is running in R82 and firewalls are in R81.20

Peer devices are Cisco routers configured on domain-based VPN using "match address <ACL>" under crypto-map.

Re: Checkpoint IPSEC VPN with 2 different links

TurgutKaplanogl — Thu, 05 Feb 2026 11:24:57 GMT

Hi @SriNarasimha005

You can implement this sk for your environment;

How to configure Site-to-Site ISP Redundancy and Tunnel Management with Third-Party VPN Gateways

https://support.checkpoint.com/results/sk/sk184489

If you want to use domain based VPN, I can provide different method.

Thank you

Re: Checkpoint IPSEC VPN with 2 different links

SriNarasimha005 — Thu, 05 Feb 2026 11:51:34 GMT

Hi @TurgutKaplanogl

Thanks for sharing it.

Can you please share it for a domain-based VPN?

Re: Checkpoint IPSEC VPN with 2 different links

the_rock — Thu, 05 Feb 2026 14:57:02 GMT

I will take a screenshot of how one of our clients has this configured for link selection and share it.

Re: Checkpoint IPSEC VPN with 2 different links

the_rock — Thu, 05 Feb 2026 15:02:21 GMT

@SriNarasimha005

This is how we did it for them with high availability ISPR.

Re: Checkpoint IPSEC VPN with 2 different links

SriNarasimha005 — Thu, 05 Feb 2026 15:58:23 GMT

Hi @the_rock

Many thanks for sharing the info. Can you please help to share the SK for domain-based VPN, so I don't miss any steps.😊

Re: Checkpoint IPSEC VPN with 2 different links

the_rock — Thu, 05 Feb 2026 16:00:57 GMT

Not sure if there is an sk or not for domain based.

Re: Checkpoint IPSEC VPN with 2 different links

SriNarasimha005 — Thu, 05 Feb 2026 16:05:24 GMT

Hi @PhoneBoy

Need your help please.

Re: Checkpoint IPSEC VPN with 2 different links

the_rock — Thu, 05 Feb 2026 16:18:55 GMT

In the meantime, maybe worth checking with TAC as well.

Re: Checkpoint IPSEC VPN with 2 different links

PhoneBoy — Thu, 05 Feb 2026 17:13:50 GMT

Considering the original poster is asking about this for internal links, I don't think ISPR is the right answer here.
You'll probably need the Enhanced Link Selection features in R82 to do this properly.
https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SitetoSiteVPN_AdminGuide/Content/Topics-VPNSG/Link-Selection-Enhanced.htm

Re: Checkpoint IPSEC VPN with 2 different links

the_rock — Thu, 05 Feb 2026 17:15:02 GMT

This is the closest one I could find.

https://support.checkpoint.com/results/sk/sk53980

Mind you, even sk @TurgutKaplanogl provided is probably relevant for domain based vpn tunnels, except you just need to modify vpn domains to proper ones, rather than empty group.

Re: Checkpoint IPSEC VPN with 2 different links

SriNarasimha005 — Fri, 06 Feb 2026 13:08:32 GMT

Hi @PhoneBoy

Many thanks for sharing it.

Yup, they're MPLS/private links and we're using IPSEC (Domain-based) VPN for better security. CP would be having the Internal IP addresses.

I don't see any SK article and below are the high-level steps. Can you please let me know if I miss anything?

1. Navigate to FW object and add both the Internal IP address which are connected to the private links

2. Create a Star VPN community

Center Gateway: Check Point ClusterXL.

Satellite Gateways: Both Cisco routers (define as interoperable devices).

3. VPN routing:

In the VPN community, set VPN Routing to "To center, or through the center to other satellites."

4. Go to Enhanced Link selection and select the Interfaces

5. Configure VPN domain, security policy as needed.

Also, can you pls let me know if DPD is enabled by default

Verify Interface Availability.

The Security Gateway uses Dead Peer Detection (DPD) to monitor the status of the interface.
Ensure that DPD packets are being sent and received correctly to maintain the active status of the tunnel

Re: Checkpoint IPSEC VPN with 2 different links

PhoneBoy — Fri, 06 Feb 2026 21:22:23 GMT

At a high level, that looks correct.
For new installs, DPD should be enabled by default: https://support.checkpoint.com/results/sk/sk108600

Re: Checkpoint IPSEC VPN with 2 different links

the_rock — Sat, 07 Feb 2026 01:44:51 GMT

Those steps look logical. I will say, sometimes, I end up putting interoperable object as center gateways if things dont work. Not often, but something to keep in mind.

Re: Checkpoint IPSEC VPN with 2 different links

SriNarasimha005 — Mon, 09 Feb 2026 12:15:22 GMT

Hi @PhoneBoy

Thanks for your help. May I request you to ask the relevant teams to prepare a SK relating to this?😊

Thank again.