> Source: [sk115250](https://support.checkpoint.com/results/sk/sk115250)

# sk115250 - Site-to-Site VPN Tunnel between Cloud Firewall for AWS Gateway and external Security Gateway can be established only by Cloud Firewall for AWS Gateway

| Property | Value |
|----------|-------|
| Solution ID | sk115250 |
| Date Created | 2016-12-28 |
| Last Modified | 2026-04-28 |
| Technical Level | Advanced |
| Products | Security Gateway, Cloud Firewall |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R82.10, R81 (EOS), R81 (EOS), R81.10 (EOS), R81.20, R82 |
| OS | Gaia |
| Platform | AWS |

## Symptoms

- * External Check Point Security Gateway fails to establish a Site-to-Site VPN Tunnel with Cloud Firewall for AWS Gateway:  

  \[Cloud Firewall for AWS Gateway\] --- (VPN) X \<--- \[Security Gateway\]

* Cloud Firewall Gateway is able to establish a Site-to-Site VPN Tunnel with external Check Point Security Gateway:  

  \[Cloud Firewall for AWS Gateway\] ---\> (VPN) --- \[Security Gateway\]

* Traffic capture on Cloud Firewall for AWS Gateway during the issue (when external Security Gateway tries to establish the VPN tunnel) does not show any ingress traffic from the external Security Gateway (shows only egress traffic towards the external Security Gateway).

## Cause

AWS security group (that acts like a security rule base) is not configured correctly to accept traffic from the external Check Point Security Gateway.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content