> Source: [sk174848](https://support.checkpoint.com/results/sk/sk174848) # sk174848 - How to set up VPN between a Check Point Security Gateway and Zscaler ZIA Public Service Edge | Property | Value | |----------|-------| | Solution ID | sk174848 | | Date Created | 2021-08-10 | | Last Modified | 2025-04-10 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) | | OS | Gaia | ## Solution **Table of Contents:** * Overview * Background * Topology * Motivation * Configuration * Notes Overview {#TOC01} ----------------- This article describes how to configure an IPSec Site-to-Site VPN tunnel with two different Zscaler ZIA Public Service Edges in the Redundancy mode. Supported Security Gateway versions: * [](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm)R81.10 and higher * [](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm)[R81 Jumbo Hotfix Accumulator](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 42 * [R80.40 Jumbo Hotfix Accumulator](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 119 * [R80.30 Jumbo Hotfix Accumulator](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.30/Default.htm) starting from Take 237 Background {#TOC02} ------------------- Security Gateway versions R80.30 and higher support the Dead Peer Detection (DPD) Mechanism in the Multiple Entry Point (MEP) feature. A MEP environment has two or more VPN Gateways, which allow protecting and enabling access to the same VPN domain. As a result, in scenarios in which the user establishes a VPN tunnel with a third-party vendor, the user can use the MEP DPD Mechanism to monitor the status of a Peer Device or a Link, and to establish a VPN Tunnel with the secondary Peer or backup Link, if the primary goes down. This feature is called the "VPN Redundancy" mode or the "High Availability" mode by other vendors. **Note:** DPD is also used for the Permanent Tunnels feature with third-party vendors. For more information, refer to the [Site to Site VPN Administration Guide](https://support.checkpoint.com/product/446#f-commonsource=C.%20Documentation) for your version. Topology {#TOC03} ----------------- ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/Capture202108041349172.png) Motivation {#TOC04} ------------------- As depicted in the diagram above, Zscaler recommends configuring two separate VPNs with two different ZIA Public Service Edges to support High Availability. If the primary IPsec VPN tunnel, or if an intermediate connection goes down, all traffic is then rerouted through the backup IPsec VPN tunnel to the backup ZIA Public Service Edge. To meet these requirements, you must configure these features on the Check Point side: * **Tunnel Monitoring** - Keeps a valid IKE SA, and monitors whether the tunnel is up or down using DPD ("Tunnel Monitoring" AKA "Permanent Tunnels"). * **High Availability** - Reroutes traffic from the primary tunnel to the backup tunnel (and vice versa), if the first tunnel goes down, using MEP configuration. * **Route traffic to the Internet through Zscaler** - Routes all traffic from the Corporate office to the Internet via VPN with Zscaler to the Internet, using a Star community. * **Nat Traversal** - To address cases where the Check Point Gateway is behind a NAT device. NAT-T is activated by default ( both as the initiator and as a responder of IKE negotiations) * **NULL Encryption** - According to the latest published configuration doc by Zscaler For more information, refer to ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/motivation after 5202108041241548.png) Configuration {#TOC05} ---------------------- 1. Create a new Interoperable Device object representing the Zscaler Edge. **Only if you use MEP** - Create **two** Interoperable Device objects - one for each Zscaler Edge. In the Interoperable Device objects, on the **General Properties** page, in the **IPv4 Address** field, enter the public IP address of the corresponding Zscaler Edge node. Example: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/1202108041140021.png) 2. In SmartConsole, create an empty **Network Group** object to serve as a VPN domain placeholder: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/1202203291355331.jpg) Example: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/0001-EmptyGroupForVPN_Domain-001202204221104461.png) 3. In the Security Gateway / Cluster object, configure the VPN Domain: 1. Open the Security Gateway / Cluster object. 2. Expand **Network Management** and click the **VPN Domain** page. 3. Select **User defined** and click the 3-dots button on the right: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/001-Gateway VPN Domain-001202204221105132.png) 4. From the drop-down menu, select the Network object or the Group object that contains all relevant internal networks / objects that will route traffic to Zscaler. 5. Click **OK** to close the Security Gateway / Cluster object. 4. Publish the session in SmartConsole. 5. Close all SmartConsole windows. 6. In the Management Database, configure the required parameters for each Interoperable Device object: 1. Connect with [Database Tool (GuiDBedit Tool)](https://support.checkpoint.com/results/sk/sk13009) to the Management Server. 2. In the top left panel, navigate to **Network Objects** \> **network_objects**. 3. In the top right panel, click the Interoperable Device object. 4. In the bottom panel, right-click the parameter **isakmp.phase2_rekeying_time** \> change the value to **28800** \> click **OK**. Example: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/GUIDBEDIT-Rekeying-002202205091810531.png) 5. In the bottom panel, right-click the parameter **tunnel_keepalive_method** \> select **dpd** \> click **OK**. Example: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/GUIDBEDIT-DPD-002202110080850041.png) 6. From the top, click the **File** menu \> click **Save All**. 7. Close Database Tool (GuiDBedit Tool). 7. Connect to the command line on the Security Management Server. 8. Log in to the **Expert** mode. 9. Modify the **$FWDIR/conf/user.def.FW1** file to enforce Universal Tunnels: 1. Back up the current file: `cp -v $FWDIR/conf/user.def.FW1{,_BKP}` 2. Edit the file: `vi $FWDIR/conf/user.def.FW1` 3. Above the last line: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/0001-user202204221208511.def.FW1-Edit.png) Add this section: ``` subnet_for_range_and_peer = { <111.x.x.x, 0.0.0.0, 255.255.255.255; 0.0.0.0>, <222.x.x.x, 0.0.0.0, 255.255.255.255; 0.0.0.0> }; ``` Where: * The IP address 111.x.x.x must be the **primary Zscaler peer IP** * The IP address 222.x.x.x must be the **secondary Zscaler peer IP** |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Note** - If you have multiple Zscaler locations, you can list all of the peers here regardless of the VPN community. The order in which the peer IP addresses are listed does not matter. | End result: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/0002-user202204221210512.def.FW1-Edit.png) 4. Save the changes in the file and exit Vi editor. 10. Connect with SmartConsole to the Management Server. 11. Create and configure a **Star** VPN Community object: 1. On the the **Gateways** page: 1. Add the Interoperable Device objects as Center Gateways 2. Add the Check Point Security Gateway / Cluster object as the Satellite Gateway Example: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/2202108041223302.1.png) 2. On the **Encryption** page, we recommend to configure these settings: * Encryption Method: IKEv2 only * Encryption Suite - IKE Security Association Phase 1: AES-256 + SHA1 + GROUP 2 * Encryption Suite - IKE Security Association Phase 2: NULL, or AES + MD5 Example: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/EncryptionSettings-001202205100801131.png) 3. On the **Tunnel Management** page: 1. In the **Permanent Tunnels** section, select **Set Permanent Tunnels**. 2. In the **VPN Tunnel Sharing** section, select **One VPN tunnel Per Gateway pair**. Example: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/2202108041225364.3.2.png) 4. On the **VPN Routing** page: Select **To center or through the center to other satellites, to Internet and other VPN targets**. Note: this setting will route all traffic over the VPN tunnel, please use with caution. If you do not wish to route all traffic to Zscaler, use "To Center only". Example: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/2202108041227365.4.1.png) 5. On the **MEP** page (only if you use MEP): 1. Select **Enable center gateways as MEP**. 2. Select **Manually set priority list** \> click **Set** \> set the Interoperable Device objects (Zscaler Edge nodes) as required \> click **OK**. Example: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/2202108041341461.5.2.1.png) 6. On the **Shared Secret** page: 1. Select **Use only Shared Secret for all external members**. 2. Configure a pre-shared key with each Zscaler Edge node (as configured on the remote site). Example: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk174848/2202108041237437.6.2.png) 7. Click **OK** to close the VPN Community object. 12. Publish the session in SmartConsole. 13. Install the Access Control Policy. Notes {#TOC06} -------------- As part of our interoperability enhancement effort, we encountered several issues when working with Zscaler Edge, either with IKEv1 or with IKEv2. Those issues were resolved in the following scenarios: * MEP-related issues in IKEv1 and IKEv2 * NULL encryption issue in IKEv2 * ID Authentication payload issue in IKEv2 * Permanent Tunnel issue in IKEv1 and IKEv2

--- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content