topic Re: How to define Remote Access VPN on Check Point Gateway in SASE and Remote Access

How to define Remote Access VPN on Check Point Gateway

JohnnyWang — Mon, 03 Nov 2025 01:08:35 GMT

Hi everyone,

I currently have a case that I’m not sure how to handle yet, and I’d like to ask if anyone who has configured a similar setup could share your experience.

Here’s the situation:

I have two separate Security Gateways (SGs) managed under the same SmartConsole. Both devices have Remote Access VPN configured. Each gateway is assigned an external DNS for access as follows:
GW1: vpn03.cybertest.com.vn
GW2: vpn04.cybertest.com.vn

The issue I’m facing is that when a user connects successfully to vpn03.cybertest.com.vn, performing a tracert shows that the connection is actually coming from the public IP of GW2. I’m not sure if this behavior is related to some kind of load balancing.

Currently, we have not enabled the load balancing feature in Global Properties. I’m considering whether I should apply the define MEP topology configuration and switch it to client_decide, since I want each user to connect to the specific VPN configured on the gateway we designate.

:automatic_mep_topology ( :gateway ( :map ( :true (true) :false (false) :client_decide (client_decide) ) :default (true) ) )

Additionally, if the VPN domain is shared between both gateways, could that cause this behavior? Or should we create a separate VPN domain for each gateway?
Looking forward to everyone’s thoughts and suggestions.

Re: How to define Remote Access VPN on Check Point Gateway

the_rock — Mon, 03 Nov 2025 01:16:59 GMT

I would say way to go here is to define different remote access vpn domain for each firewall.

Re: How to define Remote Access VPN on Check Point Gateway

Duane_Toler — Fri, 07 Nov 2025 01:47:03 GMT

Can that be done? Last time I looked at defining multiple RA communities it failed to install the policy.

EDIT: Or did you just mean VPN domains per gateway, all within the same RA community?

Re: How to define Remote Access VPN on Check Point Gateway

the_rock — Fri, 07 Nov 2025 01:48:11 GMT

Hey Duane,

Maybe I misspoke or did not explain it right. I meant DIFFERENT ra vpn domains for separate firewalls. Defining multiple remote access communities never worked, would give en error if you try to save it.

Re: How to define Remote Access VPN on Check Point Gateway

Duane_Toler — Fri, 07 Nov 2025 01:49:35 GMT

AH, ok. Yes, that might be what the OP needs to do.

Re: How to define Remote Access VPN on Check Point Gateway

the_rock — Fri, 07 Nov 2025 01:50:38 GMT

Thats my thought as well.

Re: How to define Remote Access VPN on Check Point Gateway

PhoneBoy — Fri, 07 Nov 2025 01:52:41 GMT

Actually, I was able to do it in an early R80.x version...and yeah, it's was a UI bug, since this configuration is NOT supported.

Re: How to define Remote Access VPN on Check Point Gateway

the_rock — Fri, 07 Nov 2025 01:53:52 GMT

Funny you mentioned that, I totally remember lol, it worked for 1 day I believe.