> Source: [sk182251](https://support.checkpoint.com/results/sk/sk182251) # sk182251 - Troubleshooting Connectivity Issues with Check Point SASE Agent | Property | Value | |----------|-------| | Solution ID | sk182251 | | Date Created | 2024-04-25 | | Last Modified | 2026-10-22 | | Technical Level | General | | Products | SASE | | Versions | Cloud | ## Symptoms - Unable to connect to the network with the Check Point SASE Agent. ## Cause * Incorrect connection protocol. * Firewall rules blocking traffic. ## Solution Step 1 - Change the Connection Protocol --------------------------------------- The Check Point SASE Agent (formerly named Harmony SASE) offers two major VPN protocols through which you can connect to your public and private gateways: * WireGuard * OpenVPN **Notes:** * Your Check Point SASE Agent may be set to **Default** ; this can only be modified by either an Admin or a Manager using a Policy rule under [Agent Configuration](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/cshelp.html?contextId=SASE_AGENT_USER_PROFILES). * **Default** is set to the **Wireguard** protocol for most workspaces. WireGuard and OpenVPN protocols provide high speed and security, but one may perform better based on your device and internet connection. If you encounter issues with one, switch to the other protocol. For more information, see [User Configuration Profile](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/cshelp.html?contextId=SASE_AGENT_USER_PROFILES). Step 2 - Make sure you have connectivity to these URLs ------------------------------------------------------ * Perimeter81: * `yarkon-443.perimeter81.com:443 ` * `yarkon.perimeter81.com:50051` * `api.perimeter81.com` * `sdpv2-agent-ws.perimeter81.com` * `sdp.perimeter81.com` * `perimeter81.com` * `.perimeter81.com` * `auth.perimeter81.com` * `static.perimeter81.com` * `cp-external.perimeter81.com` * `cdn.auth0.com` * `*.auth0.com` where `perimeter81.com` can be replaced by any other prod environment, for example, `eu.sase.checkpoint.com` or `au.sase.checkpoint.com` or `in.sase.checkpoint.com` * Check Point: * `upgrade.bitdefender.com` * `p81-assets.perimeter81.com` * `fonts.googleapis.com` * `url-rep.kube1.iaas.checkpoint.com` * `cws.checkpoint.com` * `web-rep.iaas.checkpoint.com` * `te.checkpoint.com` * `url-rep.iaas.checkpoint.com` * `www.w3.org/2000/svg` * `c2pa.org/manifest` * `cloudinfra-gw.portal.checkpoint.com/` * Global and EU Region - `cloudinfra-gw-eu.portal.checkpoint.com` * US Region - `cloudinfra-gw-us.portal.checkpoint.com ` * AU Region - `cloudinfra-gw.ap.portal.checkpoint.com ` * IN Region - `cloudinfra-gw.in.portal.checkpoint.comf` Step 3 - Make sure your Firewall allows Outgoing Traffic -------------------------------------------------------- The Check Point SASE Agent attempts to establish a Transport Layer Security (TLS) connection to these URLs using TCP port 443: * for Check Point SASE Agent in US. * [https://api.eu.sase.checkpoint.com](https://api.eu.sase.checkpoint.com/) for Check Point SASE Agent in EU. * for Check Point SASE Agent in AU. * for Check Point SASE Agent in IN. After authentication, the Check Point SASE Agent attempts to pull configurations from these SDP controllers using TCP port 5050: **Note**: Starting with agent version 11.7, the agent uses port 443 for SDP communication. * For Check Point SASE Agent from AU, **sdp.au.sase.checkpoint.com** * For Check Point SASE Agent from IN, **sdp.in.sase.checkpoint.com** * For Check Point SASE Agent from the US,**sdp.perimeter81.com** * For Check Point SASE Agent from EU,**sdp.eu.sase.checkpoint.com** For US Tenant: * **swg-pu-lb-production.safersoftware.net**using port 50051 for URL category queries * **yarkon.perimeter81.com** using port 50051 for agent usage information. Starting with agent version 11.7, the agent uses port 443 for agent usage information. For EU Tenant: * **swg-pu-lb-production.safersoftware.net**using port 50051 for URL category queries * **yarkon.eu.sase.checkpoint.com** using port 50051 for agent usage information. Starting with agent version 11.7, the agent uses port 443 for agent usage information. For AU Tenant: * **swg-pu-lb-production.safersoftware.net** using port 50051 for URL category queries * **yarkon.au.sase.checkpoint.com** using port 50051 for agent usage information. Starting with agent version 11.7, the agent uses port 443 for agent usage information. For IN Tenant: * **swg-pu-lb-production.safersoftware.net** using port 50051 for URL category queries * **yarkon.in.sase.checkpoint.com** using port 50051 for agent usage information. Starting with agent version 11.7, the agent uses port 443 for agent usage information. Based on the connection protocol chosen, outbound traffic is enabled with these service ports: |------------------|-------------------|------------| | **VPN Protocol** | **UDP** | **TCP** | | WireGuard | 51821, 8000, 8055 | N/A | | OpenVPN | 1194, 636 | 1195, 8443 |
**Notes:** * The ICMP (ping) protocol is not supported on the gateways. To find the list of Gateway IPs that are used by your private network, access the Check Point SASE Administrator Portal and click **Networks** . **Standard Networks:** ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182251/image-1670366961471202404291037381.png) **Enhanced Networks:** The IP address on the Networks page is the Region IP address, not the IP address that the SASE Agent uses to connect. To get the Scale Unit IP address, use one of these methods:
* Use the [Check Point SASE Public API](https://app.swaggerhub.com/apis/Check-Point/SASE-API/3.0.1#/Enhanced_Regions/getEnhancedRegion). * Configure the [Using Model Context Protocol (MCP) Server with SASE](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/SASE_Security/Topics/usingmcpserverwithharmonysase/using_model_context_protocol_mcp_with_sase.html) and ask for the Scale Unit IP address. Step 4 - Open a Support Ticket ------------------------------ Open a [support ticket](mailto:sase-support@checkpoint.com) with these details attached: **Note** - Make sure that your Check Point SASE Agent and the Operating System are up to date with the latest updates and patches, before you open a support ticket with Check Point. * Issue description. * Screenshot of the error message. * Detailed procedure followed. * Expected outcome, for example, I expect to be able to connect using Wireguard, but all of our users can only use the OpenVPN protocol. * Last occurrence of the issue. * Has this issue occurred previously, or is it the first time? If it has occurred before, when did it initially start? * [Log](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/cshelp.html?contextId=SASE_AGENT_USAGE) files from the device that experienced the issue.
--- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content