Interoperability Device Object for Dynamic IP

[Venue2185]

VPN setup where Check Point is the Hub and multiple FortiGate firewalls are the Spokes.

Topology:

• Hub: Check Point Gateway (Static Public IP)
• Spokes: FortiGate Firewalls (Dynamic Public IP)
• VPN Type: Route-Based VPN (VTI) with BGP
• Each FortiGate spoke receives a dynamic public IP from its ISP.

I would like to know whether it is necessary to create an Interoperable Device object with a dynamic IP address for each FortiGate spoke in Check Point.

Since the spoke gateways do not have static public IP addresses, I am unsure about the recommended configuration on the Check Point side.

Has anyone deployed a similar Hub-and-Spoke environment with Check Point as the Hub and FortiGate devices using dynamic public IPs?

If so, could you please share:
Configure the Interoperable Device object with a Dynamic IP on the Check Point side, is Certificate Authentication (CA).

[PhoneBoy]

Interoperable Device objects are needed for each Fortigate.
If they do not have a fixed IP, you must use the Dynamic IP option.
This necessitates establishing certificate-based authentication for the Fortigate peers as we do not allow PSKs with Dynamic IP VPN peers.

[Venue2185]

Thanks for reply @PhoneBoy  Don't have an external CA server. Can we use the SMS as the CA server for IPsec certificate-based authentication only? Also, can the FortiGate device CSR be signed by the SMS?@PhoneBoy