Different PSKs for external VPN gateway

[Teddy_Brewski]

Hello,

Two gateways, FW-GW-A and FW-GW-B, with two separate default routes and public IPs, running Check Point r80.40 and managed by one SmartCenter.

There is a IPSec tunnel with the external client (FW-EXT-CLIENT-A) on one of the gateways (FW-GW-A). We need to setup additional tunnel with the same FW-EXT-CLIENT-A, on another gateway (FW-GW-B), but with the different PSK.

Can I just create another VPN community and set a desired PSK, or it will overwrite the PSK for the first tunnel too? In other words, is PSK bound to the VPN community object or firewall object?

Thank you.

[RS_Daniel · Accepted solution]

Hello,

You can create a new vpn domain and put a different psk. Some troubles can appear regarding encryption domains or the peer IP address, the remote and local vpn domains will be the same for both vpn's? the public IP of the remote gateway will be the same?

Regards

[Teddy_Brewski]

@RS_Daniel thank you.

The peer IP of FW-EXT-CLIENT-A is the same, public IPs of FW-GW-A and FW-GW-B are different.

Local VPN domains are different too, however the remote VPN domain is the same.

[RS_Daniel]

Hello,

Local VPN domains are different --> i think it solves any overlapping networks issues, it should work using a new vpn community, i have the same scenario with one customer and didn't have any problem.

Regards