topic Re: S2S With Cato in General Topics

S2S With Cato

RemoteUser — Tue, 05 May 2026 09:15:41 GMT

Hi Mates,

I have a question regarding the setup of a Site-to-Site VPN between a Check Point cluster and two Cato peers with redundancy.

What is the best way to configure this scenario to ensure proper redundancy and failover between the two peers? Thanks

Re: S2S With Cato

simonemantovani — Tue, 05 May 2026 09:18:44 GMT

Hello

the best solution is to use route based vpn with dynamic routing protocol like BGP.

Re: S2S With Cato

RemoteUser — Tue, 05 May 2026 09:36:14 GMT

Hi Simone,

Is it also possible to achieve this using MEP, with the center gateways acting as the peer gateways? And in satellite gateways my checkpoint cluster?

Re: S2S With Cato

simonemantovani — Tue, 05 May 2026 10:06:51 GMT

MEP is only available between Check Point gateways.

I'm pretty sure that Cato support VPN route-based with BGP (or eventually static routing); I found a documentation page from Cato official site related to VPN between AWS gateway with redundancy.

Usually if you need redundancy, the best solution (adopted also by cloud provider, Harmony SASE, etc.) is route based vpn with routing protocol.

Re: S2S With Cato

RemoteUser — Tue, 05 May 2026 12:54:32 GMT

hi simone,
so i need to create VTI for this right?

Re: S2S With Cato

simonemantovani — Tue, 05 May 2026 12:55:28 GMT

Yes, you should create 2 VTIs numbered

Re: S2S With Cato

RemoteUser — Tue, 05 May 2026 15:33:38 GMT

We also need to configure two networks between the Check Point cluster and the remote peers (e.g., 169.254.x.x), one for each tunnel, and then set up the routing accordingly, right?

Re: S2S With Cato

simonemantovani — Tue, 05 May 2026 16:24:17 GMT

Yes you're right.

Have you already configured a route based vpn in the past?

Re: S2S With Cato

RemoteUser — Tue, 05 May 2026 16:42:31 GMT

Yes, with AWS the usually provide a file with all the steps to follow, while in this case we don’t have it, which is why I’m asking.

At this point, we also need to inform the other side that we are going to set up a VTI tunnel, since they will need to configure the corresponding networks (169.254.x.x) accordingly as well. Am I right?