topic Re: VPN on DAIP in General Topics

VPN on DAIP

KM1895 — Tue, 21 Apr 2026 11:10:10 GMT

hi,

Im currently helping a customer with a site to site vpn, between to quantum spark gateways, where one is DAIP.

After registereing a ddns address, i can easily log on and manage it, and it has a rulebase.

But we are struggling to get the vpn up and running, with only a generic "ike failure, error occured" message when we initiate traffic.

I havent been able to find much documentation on how to properly set this up, and best practices, so i hope i might get some good feedback on here.

the gateways are both centrally managed from the same mgmt server.

Br,

Re: VPN on DAIP

emmap — Tue, 21 Apr 2026 11:19:08 GMT

Did you set permanent tunnels on the gateway? Do you have the link selection configured all good on both ends? Which end are you sending traffic from to test?

Re: VPN on DAIP

KM1895 — Tue, 21 Apr 2026 11:22:37 GMT

hi,

I set permanent tunnels, yes.

Link selection on DAIP is set to dns resolving, with the ddns.net address put in. Havent changed link selection on center gateway, as that is not a DAIP.

We are initiation traffic from the DAIP gateway, as that is the way the traffic is meant to flow, and also the only supported way, if i remember correctly.

Re: VPN on DAIP

emmap — Tue, 21 Apr 2026 12:16:57 GMT

Link selection is still relevant to the non DAIP gateway - is the main IP on the general page of the gateway properties the internet IP? If not, you will need to set the correct external IP in link selection on that gateway and install policy to both of them. Or set the main IP to the internet IP and push policy to both.

Re: VPN on DAIP

KM1895 — Tue, 21 Apr 2026 13:21:38 GMT

yes, the link selection is correct for the non daip. this vpn community is already in production with other satelite gateways, and working..its just this DAIP gateway we are struggling with.

Re: VPN on DAIP

the_rock — Tue, 21 Apr 2026 13:33:46 GMT

See if below helps.

https://community.checkpoint.com/t5/Firewall-and-Security-Management/VPN-site-to-site-with-Remote-Peer-Dynamic-IP/m-p/180681#M33028

Re: VPN on DAIP

emmap — Wed, 22 Apr 2026 02:50:42 GMT

OK, if there's no useful information in the VPN logs for the key exchange failure specifically, it's time to get some VPN debug logs and open a TAC case so they can help figure it out.

https://support.checkpoint.com/results/sk/sk62482