> Source: [sk1000180](https://support.checkpoint.com/results/sk/sk1000180)

# sk1000180 - Site-to-site VPN traffic fails when static routing forces an internal source IP for traffic sourced from the gateway destined to the peer VPN domain.

| Property | Value |
|----------|-------|
| Solution ID | sk1000180 |
| Date Created | 2026-09-23 |
| Last Modified | 2026-09-30 |
| Technical Level | Advanced |
| Products | Security Gateway, Check Point Firewall |
| Versions | R82.10, R82, R82.20 |

## Symptoms

- * After a static route is added to force the Check Point Firewall-originated traffic to use an internal interface or internal next hop, gateway-originated VPN traffic works, but traffic from internal hosts fails.
* Hosts located in the same subnet as the Firewall's internal interface cannot communicate through the VPN tunnel.
* The same routing design worked on earlier Check Point Firewall versions, but fails on Firewalls running R82 and higher.

## Cause

The environment uses an unsupported routing method in R82 and higher versions.

A static route is configured to point either to a local internal interface or to a next hop located in the local internal subnet. This route is intended to force locally generated gateway traffic to use the Check Point Firewall's internal IP address as the VPN source address.

In R82 and higher versions, this routing design is not supported. Under these conditions, traffic can be routed in a way that results in ICMP redirect processing and packet drops, preventing the expected VPN communication flow.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content