topic Re: Setup remote 2530 gateway to be managed centrally by Management Server in Spark Firewall (SMB)

Setup remote 2530 gateway to be managed centrally by Management Server

RafaelBohrer — Fri, 05 Jun 2026 13:21:23 GMT

Hello all.

I'm trying to setup a 2530 gateway in a remote site but it need be mananged by my central Management Server.

I've tried to use NAT all SIC ports directly to the SMS to connect the 2530 to my SMS. The trust is established, but I can`t fetch the policies.

How is the best practice to setup a remote gateway? I've read many saying to establish site-to-site VPN first.

Should I first configure 2530 in local mode, set the tunnel and then convert to central management?

Is there any document to help me?

Here is my topology.

Central Site:

1x 3920 Gateway with SD-WAN enabled. (Gaia 82.10 JHT19)

3 external connections
- 1 directly connect with public IP
- 2 behind a ISP modem with internal IP addresses

1x Management Server with 1 internal IP address (Smart Console 82.10)

Remote Site

1x 2530 Gateway just with the initial setup done. (Gaia 82)

1 external connection behind ISP modem with DMZ configured to send to 2530 gateway IP
1 fixed public IP address

Regards.

Rafael Bohrer

Re: Setup remote 2530 gateway to be managed centrally by Management Server

Alex- — Fri, 05 Jun 2026 16:59:30 GMT

You should consider "Management behind NAT", which also correctly populates the masters file on the remote gateway.

https://sc1.checkpoint.com/documents/R82.10/WebAdminGuides/EN/CP_R82.10_SecurityManagement_AdminGuide/Content/Topics-SECMG/Security_Management_behind_NAT.htm

Re: Setup remote 2530 gateway to be managed centrally by Management Server

RafaelBohrer — Fri, 05 Jun 2026 17:26:49 GMT

Thanks Alex. I`ll check it out.

Re: Setup remote 2530 gateway to be managed centrally by Management Server

RafaelBohrer — Mon, 08 Jun 2026 14:14:06 GMT

Hello Alex.

I've followed the steps from the documentation. The 2530 established the communication, but still dot fetching the policies.

Here's the error message on 2530 WebGui

Any thing that I'm missing?

Regards.

Re: Setup remote 2530 gateway to be managed centrally by Management Server

Alex- — Mon, 08 Jun 2026 14:25:04 GMT

You can reset the SIC on the SMS and set it to wait for first contact, then install the policy on your gateway object. Check the first option on the install screen, "install independently..." and uncheck the "if it fails on one gateway..." then proceed.

From the WebUI of the Spark, reinitialize SIC with the password you set in the manager.

Re: Setup remote 2530 gateway to be managed centrally by Management Server

RafaelBohrer — Mon, 08 Jun 2026 19:20:28 GMT

Still not working, but now this message on Test SIC Connection in SmartConsole

SIC Status for SC-CPFW-01: Unknown

Could not establish TCP connection with 179.219.xxx.xxx

** Please make sure that Check Point Services are running on SC-CPFW-01 and that TCP connectivity is allowed from Security Management Server to IP 179.219.xxx.xxx, Port 18191 **

Re: Setup remote 2530 gateway to be managed centrally by Management Server

RafaelBohrer — Thu, 11 Jun 2026 13:16:51 GMT

Hello all.

I found the problem. As I have multiple WAN links and SD-WAN enabled, the 3920 was reciving the communication in WAN1, but was responding using WAN2. I fixed the route and it worked.

Thanks for all help.

Regads.