Few more questions and answers:
Other solutions that connect SD-WAN gateways to the cloud manage the tunnels and handle peering to the closest cloud edge and rekeying. Is there anything that talks between the Check Point edge and the cloud to do something like this?
CloudGuard Edge is installed per edge device. With CloudGuard Connect, you configure which location is closest to your office. Assuming that the office doesn't move, this should work. Roaming users can use Capsule Cloud until this functionality gets integrated within CloudGuard Connect.
Can VPN redundancy can be to multiple Check Point CloudGuard Connect locations?
The two tunnels per branch device go to different data centers in the same region.
Is the authentication on the IPsec tunnel only PSK or are certificates supported?
Currently, only PSK authentication is supported. Note that none of the popular SD-WAN solutions support certificate-based authentication currently. If this is a requirement, please contact us.
Is there any integration with Check Point Zero Touch?
Yes, Check Point SMB devices are supported. Step-by-step instructions exist on the Infinity Portal.
Is there any bandwidth limit?
Currently it is 850mbps per site object. You can split your subnets at the same branch office into multiple site objects on the Infinity Portal.
What's the Service Level Agreement for CloudGuard Connect
A formal document will be made available shortly, but the SLA is 99.999% thanks to our public cloud infrastructure and reliable mature security products.
Will it be possible to have policy that determines which application will use which IPsec tunnel/connection? Are there any options in the policy that determine if the latency or packet loss of a link reaches a certain threshold, an uplink won't be used anymore? Is there dynamic path selection possible?
This is a function provided by most SD-WAN Edge Devices. It is configured on the device, not in CloudGuard Connect.