topic Re: S2S With Cato in General Topics

S2S With Cato

RemoteUser — Tue, 05 May 2026 09:15:41 GMT

Hi Mates,

I have a question regarding the setup of a Site-to-Site VPN between a Check Point cluster and two Cato peers with redundancy.

What is the best way to configure this scenario to ensure proper redundancy and failover between the two peers? Thanks

Re: S2S With Cato

simonemantovani — Tue, 05 May 2026 09:18:44 GMT

Hello

the best solution is to use route based vpn with dynamic routing protocol like BGP.

Re: S2S With Cato

RemoteUser — Tue, 05 May 2026 09:36:14 GMT

Hi Simone,

Is it also possible to achieve this using MEP, with the center gateways acting as the peer gateways? And in satellite gateways my checkpoint cluster?

Re: S2S With Cato

simonemantovani — Tue, 05 May 2026 10:06:51 GMT

MEP is only available between Check Point gateways.

I'm pretty sure that Cato support VPN route-based with BGP (or eventually static routing); I found a documentation page from Cato official site related to VPN between AWS gateway with redundancy.

Usually if you need redundancy, the best solution (adopted also by cloud provider, Harmony SASE, etc.) is route based vpn with routing protocol.

Re: S2S With Cato

RemoteUser — Tue, 05 May 2026 12:54:32 GMT

hi simone,
so i need to create VTI for this right?

Re: S2S With Cato

simonemantovani — Tue, 05 May 2026 12:55:28 GMT

Yes, you should create 2 VTIs numbered