> Source: [sk182225](https://support.checkpoint.com/results/sk/sk182225)

# sk182225 - Check Point SASE Frequently Asked Questions (FAQ)

| Property | Value |
|----------|-------|
| Solution ID | sk182225 |
| Date Created | 2024-04-19 |
| Last Modified | 2026-08-16 |
| Technical Level | General |
| Products | SASE |
| Versions | Cloud |

## Solution

Frequently Asked Questions
--------------------------

Click Here to Show the Entire FAQ

1. **What is Check Point SASE?**  
   > Check Point SASE is a cloud-based Network as a Service designed to simplify secure network, cloud and application access for the modern and distributed workforce. It incorporates the Zero Trust and Software-Defined Perimeter models. For more information regarding it's features, we recommend going over our [Getting Started](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/Content/Topics-SASE-AG/Getting-Started-Harmony-SASE/Getting-Started.htm) page.
2. **What are Check Point SASE's key features?**  
   > * **Software-Defined Perimeter (SDP)**: SDP technology creates a dark network where all resources are hidden and inaccessible to unauthorized users. Each user must authenticate and be validated before gaining access, essentially following a "zero trust" model.
   > * **Zero Trust Network as a Service (ZTNA)**: Zero Trust Network is an IT security model that requires all users, even those inside the organization's network, to be authenticated, authorized, and continuously validated before being granted or keeping access.
   > * **Secure Cloud and Network Access**: Check Point SASE allows businesses to create their own dedicated, cloud-based networks. Users can then securely access these networks from anywhere, making it ideal for remote teams.
   > * **Automatic Wi-Fi Security**: This feature immediately encrypts user data the moment a device connects to an unsecured Wi-Fi network, ensuring that sensitive business information is always kept safe.
   > * **Single Sign-On (SSO) Integration**: Check Point SASE integrates with various SSO providers, simplifying the login process and reducing the risk of password-related security incidents.
   > * **Two-Factor Authentication (2FA)**: This additional layer of security ensures that users must provide two forms of identification before they can access your business's network.
   > * **Role-Based Access Control (RBAC)**: You can manage and control network access on a per-role basis, giving certain users more access privileges than others based on their role in your company.
   > * **Cross-Platform Applications**: Check Point SASE provides native applications for all major platforms, ensuring secure access for all users, regardless of the device or operating system they use.
3. **How do I get started with Check Point SASE?**  
   > * **Create your Network**: This involves setting up your secure network, which includes regions and private gateways.
   > * **Connect your On-Prem and Cloud Infrastructure**: You can deploy site-to-site tunnels to securely connect your local and cloud resources.
   > * **Invite your Employees**: Integrate with your Identity Provider and invite your users. Create or import your user groups and build user-centric network or application policies accordingly.
   > * **Set Up Secure Access Rules (Zero Trust Network Access)**: Download and deploy Check Point SASE's agents to your organization-managed devices. Configure agent-less access, Zero Trust Applications, user-centric firewall policies, device posture check rules.
   > * **Set Up Secure Internet Rules (Secure Web Gateway)**: Configure the Web Security policies and set up Bypass Rules for traffic that should not be inspected. Advanced Malware Protection is enabled by default.
   > * **Watch your Network**: Track member activities and alerts, active sessions, user devices, compliance status, malware reports, web activity reports, network firewall logs, and more.
   >
   > <br />
   >
   > For more information, see [Getting Started.](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/Content/Topics-SASE-AG/Getting-Started-Harmony-SASE/Getting-Started.htm)
4. **How do I create a Network on Check Point SASE?**  
   > See [Creating a Network](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/Content/Topics-SASE-AG/Networks/Creating-a-network.htm?tocpath=Networks%7C_____4).
5. **How can I add additional regions to my network?**  
   > See [Adding Regions](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/Content/Topics-SASE-AG/Networks/Managing-Networks.htm?tocpath=Networks%7CCreating%20a%20Network%7CManaging%20a%20Network%7C_____2#Adding_Regions).
6. **Why do I lose connection to the Check Point SASE agent, or have disconnection issues when I make changes to tunnels or gateways?**  
   > * When you make a change to your gateway (add/remove/update tunnels) these changes need to be replicated on the gateway, as such, whenever you perform one of the actions above, your gateway momentarily restarts the service, and any active connections are severed until the service fully restarts.
   > * You and your users experience momentarily disconnected after a change or update, lasting only until the tunnel to commits the changes.
   > * We recommend any maintenance on tunnels or gateways be performed after business hours to avoid any service disruptions, as well as to minimize downtime.
7. **What internal subnet ranges can my Check Point SASE network use?**  
   > * The workspace Admin decides this when creating the network.
   > * A single network forms a subnet on one of the supported internal IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 198.18.0.0/15 (RFC 2544 benchmarking range). Supported subnet masks vary by range, from /22 up to the maximum mask supported for the selected range, depending on the number of gateways the network must support.
   > * Every gateway reserves 1024 IP addresses, hence our highest mask (/22) allows only for the creation of a single gateway.
   > * Our default subnet with a mask is 10.255.0.0/16.
   >
   > ***Subnet Sizing:***
   > * 10.0-255.0.0/8 range should have a minimum of /22 and a maximum of /12 - **a /22-bit mask allows a single Check Point SASE Gateway**, and /12 allows up to 1024 Gateways.
   > * 172.16-31.0.0/12 range should have a minimum /22 and maximum /12 - **a /22-bit mask allows a single Check Point SASE Gateway**, and /12 allows up to 1024 Gateways.
   > * 192.168.0.0/16 range should have a minimum /22 and maximum /16 - **a /22-bit mask allows a single Check Point SASE Gateway**, and /16 allows up to 64 Gateways.
   > * 198.18.0.0/15 (RFC 2544 benchmarking range) should have a minimum /22 and maximum /15 - **a /22-bit mask allows a single Check Point SASE Gateway**, and /15 allows up to 128 Gateways.
   >
   > <br />
   >
   > You can see below how the corresponding CIDR range affects the planning of your Check Point SASE network. Be sure not to set your range too high if you plan on adding gateways later for scalability, or else you need to delete the network to adjust the range.  
   >
   > | **CIDR Range** | **Number of Gateways** |
   > |----------------|------------------------|
   > | /22            | 1                      |
   > | /21            | 2                      |
   > | /20            | 4                      |
   > | /19            | 8                      |
   > | /18            | 16                     |
   > | /17            | 32                     |
   > | /16            | 64                     |
   >
   > <br />
   >
   > **Note** - According to your needs, you can scale up or scale down the number of Check Point SASE gateways in each Region of your network. Check Point recommends adding a gateway per every 100 members who access the region.  
   >
8. **How can I ensure my users are connected to the VPN?**  
   > Here is a list of features the workspace Admin can activate within the [user's VPN client configuration](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/Content/Topics-SASE-AG/Team/User-Profiles.htm?Highlight=users) to ensure the users are connected to the VPN when the Admin needs them to:
   > * **Automatic Wi-Fi Security** - This feature checks if the user is connected to an "Unsecured" Wi-Fi network, if the Check Point SASE Client is on and an unsecured network is detected, they are automatically connected to the VPN.
   > * **Trusted Wi-Fi Networks** - This is a list of exceptions for the "Automatic Wi-Fi Security" feature. Enter an SSID of an "Unsecured" network to not trigger an automatic connection to the VPN.
   > * **Trusted Wired Networks** - This is a list of exceptions for the "Always On" feature. Enter the name of a local network and the MAC address of its' router to not trigger an automatic connection to the VPN.
   > * **Always-ON** - This feature does not let the user disconnect from the VPN, it disables the "Disconnect" button and requires a special code to exit the VPN.
   > * **Kill Switch**- To avoid data leaks, if any disconnection is detected with the VPN (even one caused by the local internet connection, like a slight disconnection to the Wi-Fi) the computer's internet connection is turned off, and the user is no longer able to use the internet.
   > * We recommend turning the Kill Switch feature off unless specifically required, as it may not be pleasant for non-technical users.
9. **How can I improve the File Sharing speed I get using Microsoft Windows?**  
   > Due to [known limitations](https://docs.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/slow-file-transfer) with SMB protocol (this is the protocol used by Microsoft Windows for sharing files), there might be latency issues when downloading files or accessing a shared remote Windows resource.  
   >
   > The issue reported is usually something along the lines of this:
   > * Internet connections are stable and have decent speed.
   > * Other file transfers like FTP are fine.
   > * File transfers using Windows file shares (i.e., SMB or CIFS) are slow.
   >
   > IT Engineers can perform the following tests to verify the problem:
   > * The ping test shows a normal connection speed.
   > * iPerf on SMB ports to the affected resource show slow responses.
   >
   > To improve SMB speeds over VPN, there are a few steps we can recommend:
   > 1. Moving away from a [Wireguard Site-to-Site connection](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/Content/Topics-SASE-AG/Networks/WireGuard-connector.htm?TocPath=Networks%7CStep%202%20-%20Adding%20a%20Tunnel%7C_____2) on a standalone machine in the network which depends on NAT rules (Wireguard Connector) to reach the internal LAN, to a [Traditional IPsec Site-to-Site Tunnel](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/Content/Topics-SASE-AG/Networks/Adding-a-Tunnel.htm) which is connected to the actual Router has been shown to improve SMB connection speed.
   > 2. Fine-tuning the SMB Server.  
   >    External links from Microsoft regarding fine-tuning an SMB server:
   >    * [How to check and upgrade the SMB version on the file server to Version 2 or 3](https://docs.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3)
   >    * [Microsoft's recommendation for fine-tuning an SMB Server](https://docs.microsoft.com/en-us/windows-server/administration/performance-tuning/role/file-server/smb-file-server)
   > 3. Review MTU sizes of all the interfaces on the way (the Maximum Transmission Unit size indicates how long the packet allowed on the interface is) and make sure they all match:
   >    * To check MTU size via Powershell:  
   >      `netsh interface ipv4 show subinterface`
   >    * To Change MTU size on Interface "Local Area Connection" (might be named differently on your system) to 1420, via Powershell:  
   >      `netsh interface ipv4 set subinterface "Local Area Connection" mtu=1420 store=persistent`
10. **What IP will be displayed in the agent when the split tunneling is enabled?**  
    > The agent displays your local ISP's public IP:  
    > When split tunneling is enabled, the agent adds a route that directs traffic to subnets that are listed under the split tunneling settings. The rest of the traffic is routed through a local ISP.
11. **After activating SMS Multi-Factor Authentication I get the below error when trying to access the platform, how can I resolve this error?**  
    > You may occasionally run into the error when trying to log in to Check Point SASE:  
    > "`We could not send the SMS. Please try the recovery code`"  
    >
    > This error may occur when you reach the 10 SMS per hour limitation. We use active brute force protection, users that attempt to log in multiple times or failed to enter the correct code multiple times may encounter this error.  
    > To resolve it, you can either use your recovery code or wait 1 hour until the limit resets.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content