> Source: [sk180252](https://support.checkpoint.com/results/sk/sk180252)

# sk180252 - Route Injection Mechanism (RIM) in R81.10 does not work as expected with LSM satellite gateways

| Property | Value |
|----------|-------|
| Solution ID | sk180252 |
| Date Created | 2022-11-09 |
| Last Modified | 2025-11-09 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server |
| Versions | R81.10 (EOS), R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * When a VPN tunnel between an LSM gateway and the primary central gateway goes down, users behind the LSM gateway lose connectivity.
* RIM does not propagate the LSM Gateway's encryption domain to the backup central gateway as expected. When an administrator prints the routes of the central gateway by running the `show route` command in Gaia Clish, the expected kernel routes do not appear.
* Installing policy twice on the backup central gateway resolves the issue.

## Cause

In R81.10 there are two VPN demons - the new *iked* daemon and the legacy *vpnd* daemon. Only the *vpnd*daemon supports RIM with DAIP peers (that get their main IP address dynamically).

## Solution

This problem was fixed. The fix is included starting from:

* [Check Point Quantum R81.20](https://support.checkpoint.com/results/sk/sk173903)

<br />

To use RIM with DAIP peers in a Security Gateway R81.10, you must disable the *iked* daemon.

As a result, the legacy *vpnd* daemon starts to manage VPN tunnel establishment and RIM.

You can disable the *iked*daemon in two ways - permanently or temporarily.

### To disable the *iked* daemon permanently (survives reboot):

This solution requires a reboot of the central gateway, and survives a reboot.

1. Connect to the command line on the Security Gateway / each Cluster Member that is configured as a Central Gateway in the VPN Community.
2. Log in (Expert mode or Gaia Clish).
3. Configure the value 0 for the kernel parameter *ike_in_separate_daemon* :  
   `fw ctl set -f int ike_in_separate_daemon 0`
4. Reboot the Security Gateway / each Cluster Member.
   * In a High Availability cluster, reboot all Standby members and then reboot the Active member.
   * In a Load Sharing Unicast cluster, reboot all Non-Pivot members and then reboot the Pivot member.
   * In a Load Sharing Multicast cluster, reboot the members one by one.

**Important** - To enable the *iked* daemon again, repeat the procedure to configure the value 1 (one) for the kernel parameter with the "`fw ctl set -f int ike_in_separate_daemon 1`" command.

<br />

### To disable the *iked* daemon temporarily (does not survive reboot):

This solution does **not** require a reboot of the central gateway, and does **not** survive reboot.

1. Connect to the command line on the R81.10 Security Gateway / each Cluster Member that is configured as a Central Gateway in the VPN Community.
2. Log in to the Expert mode.
3. Disable the *iked* daemon:  
   `vpn iked disable`
4. Examine the *iked* daemon status:  
   `vpn iked status`

**Important** - To enable the *iked* daemon again, run the "`vpn iked enable`" command.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content