> Source: [sk122256](https://support.checkpoint.com/results/sk/sk122256)

# sk122256 - How to configure OSPF over VTI on locally managed SMB appliance

| Property | Value |
|----------|-------|
| Solution ID | sk122256 |
| Date Created | 2018-01-07 |
| Last Modified | 2022-07-24 |
| Technical Level | General |
| Products | Spark Firewall (Locally Managed) |
| Versions | R81.10.X |
| Platform | 6, 20, 400, 110, 1500, 1600, 1800 |

## Solution

**Create new VPN site:**

1. Insert the external peer IP address.  

2. Insert pre-shared secret key.  

3. In the **Remote Site Encryption Domain** , select the option - 'Encrypt according to routing table'.  

4. Choose the preferred encryption method and click on apply. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1515325054565/new vpn site1801070342.PNG)

   * Optionally to avoid overlapping between encryption domains:  
     Go to Site to Site tab -\> Advanced -\> click on 'automatically according to topology' and select 'Define local network topology manually'.

     ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1515325054565/manually encryption domain1801070347.PNG)

1. Add the local encryption domain that you want to include in the VPN connection. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1515325054565/local encryption domain1801070348.PNG)

* Perform this process for both sides as well.

**Create VTI :**

1. Go to Device tab -\> Local Network -\> New VPN Tunnel (VTI).
2. Define Tunnel ID \[for instance 10\].
3. The peer name should be the same as VPN site name \[this step is very important, in case a different name is used -- the VPN tunnel will fail\].
4. Add IP addresses for local site and for the remote site.

For example:

![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1515325054565/VTI1801070352.PNG)

* Perform this step for the peer device.

**Configure OSPF:**

1. Open SSH connection for the gateway.
2. Run from the clish, the following commands:  

   *# set ospf area backbone on* *# set ospf interface \[VTI name\] area backbone on* *# set ospf interface \[local LAN interface where the local encryption domain is configured\] area backbone on*

For example:

# *set ospf area backbone on* *# set ospf interface vpnt10 area backbone on* *# set ospf interface LAN6 area backbone on*

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk122256/set ospf choose interface - vti - vpnt101801070357.PNG)

* Perform this step for the peer device as well.

After configuring all the steps above on both sides, the routing table on each appliance will show a dynamic route with the local encryption domain and the VTI IP address of the peer.

As you can see below:

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk122256/routing table1801070358.PNG)

* You can also view the OSPF route in the CLI by running: *show route ospf*

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk122256/ospf view command1801070400.PNG)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content