> Source: [sk182799](https://support.checkpoint.com/results/sk/sk182799)

# sk182799 - How to configure Site-to-Site VPN between Microsoft SSE and an on-premises Check Point SD-WAN Security Gateway

| Property | Value |
|----------|-------|
| Solution ID | sk182799 |
| Date Created | 2024-10-31 |
| Last Modified | 2024-11-03 |
| Technical Level | General |
| OS | Gaia |

## Solution

### Why Quantum SD-WAN needs to integrate with Microsoft SSE

Integrating Check Point SD-WAN with Secure Service Edge (SSE) vendors is crucial for enhancing network security and performance.

This integration ensures seamless, secure access to applications and data, regardless of location.

It combines the robust connectivity of SD-WAN with the comprehensive security features of SSE, providing a unified solution that improves user experience, reduces complexity, and strengthens overall cybersecurity posture.

**Check Point Quantum SD-WAN integrates with Microsoft Secure Service Edge (SSE) as described below.**

This integration ensures that users benefit from enhanced security and optimized network performance, making it a reliable and efficient solution for modern digital environments.

### Supported Configuration

Check Point SD-WAN supports these deployments with Microsoft SSE:

**Scenario 1 - Check Point Security Gateway / Cluster that connects to two Microsoft SSE Gateways without Zone redundancy.**
> Each SSE Gateway connects to the Check Point Security Gateway / Cluster through different External Interface / ISP Links.
>
> There is **no** Zone redundancy at the SSE level.
>
> Example Diagram:
>
> ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture01202410312119491.png)

**Scenario 2 - Check Point Security Gateway / Cluster that connects to two Microsoft SSE Gateways with Zone redundancy.**
> Each Zone with SSE Gateways connects to the Check Point Security Gateway / Cluster through different External Interface / ISP Links.
>
> There **is** Zone redundancy at the SSE level.
>
> See the configuration procedure below.
>
> Example Diagram:
>
> ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture02202410312120252.png)

In each of the above scenarios, the Check Point Security Gateway / Cluster can receive traffic from each of Microsoft SSE endpoints and send the traffic through either of those endpoints.

The traffic is not necessarily symmetric from the VPN peers' perspective.

### Configuration Procedure for a Check Point Security Gateway / Cluster that connects to two Microsoft SSE Gateways with Zone Redundancy

**Prerequisites:**

1. Configure the required physical interfaces on the Check Point Security Gateway / each Cluster Member.

2. In Check Point SmartConsole, configure the Security Gateway / Cluster object and establish SIC.

**Part 1 of 4 - In the Microsoft Entra portal**

1. Go to "**Global SecureAccess** " \> "**Remote Networks**".

2. Create a remote network.

3. In the remote network, in the **Links** section, create a dedicated Link for each ISP, to which the Check Point Security Gateway connects.

   For example, if the Check Point Security Gateway has two ISPs, then create two dedicated Links:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture03202410312120513.png)
4. In each Link, on the "**General**" tab, configure these settings:

   1. In the "**Device IP address**" field, enter the IP address that the ISP assigns the Check Point Security Gateway's external interface.

   2. In the "**Device BGP address**" field, enter the IP address of the corresponding VPN Tunnel Interface (VTI) on the Check Point Security Gateway.

   Example:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture04202410312121054.png)
5. In each Link, on the "**Details**" tab, configure the desired encryption and PSK settings.

   Example:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture05202410312121225.png)
6. In each Link, save the settings.

7. Go back to the "**Remote network**" main tab.

8. Examine the remote network configuration:

   1. On the right side of the relevant remote network, click "**View configuration**".

      Example:

      ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture06202410312121446.png)
   2. Examine the configuration for each link:

      * Each link has the unique "`id`" and the unique "`displayName`".

      * In the section "`localConfigurations`":

        * The "`endpoint`" parameter contains the Public IP address of the Microsoft SSE Gateway.

        * The "`bgpAddress`" parameter contains the BGP IP address of the Microsoft SSE Gateway.

      * In the section "`peerConfiguration`":

        * The "`endpoint`" parameter contains the Public IP address of the Check Point Security Gateway's external interface.

        * The "`bgpAddress`" parameter contains the BGP IP address of the Check Point Security Gateway's VTI.

      Example:{#MS_View_Configuration}

      ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture07202410312121577.png)

**Part 2 of 4 - On the Check Point Security Gateway / Cluster**

**Important Note** - In ClusterXL, you must configure all cluster members in the same way.

1. Configure the required static routes so the Check Point Security Gateway sends the VPN negotiation traffic through the correct external interface (the correct ISP Link) to the relevant Microsoft endpoint.

   Note - In Microsoft configuration, each Link has its own Microsoft endpoints that communicate with it.

   Example for two Links with two endpoints each (refer to the "View configuration" example above):
   1. For the two endpoints of the First Link, configure these two static routes:

      > `set static-route 20.217.134.140/32 nexthop gateway address 141.226.<AAA>.<BBB> on`
      >
      > `set static-route 20.217.134.141/32 nexthop gateway address 141.226.<AAA>.<BBB> on`
      >
      > `save config`
   2. For the two endpoints of the Seconds Link, configure these two static routes:

      > `set static-route 20.217.128.110/32 nexthop gateway address 62.0.<CCC>.<DDD> on`
      >
      > `set static-route 20.217.128.111/32 nexthop gateway address 62.0.<CCC>.<DDD> on`
      >
      > `save config`

   See the [Gaia Administration Guide](https://support.checkpoint.com/product/73#q=Gaia%20Administration%20Guide&f-commonsource=C.%20Documentation) for your version.
2. Create a Numbered VTI for each Microsoft Endpoint.

   Example (refer to the "View configuration" example above):
   > `add vpn tunnel 11 type numbered local 172.16.33.10 remote 172.16.50.10 peer MicrosoftSSE1`
   >
   > `add vpn tunnel 12 type numbered local 172.16.33.10 remote 172.16.60.10 peer MicrosoftSSE2`
   >
   > `add vpn tunnel 21 type numbered local 172.16.34.10 remote 172.16.150.10 peer MicrosoftSSE3`
   >
   > `add vpn tunnel 22 type numbered local 172.16.34.10 remote 172.16.160.10 peer MicrosoftSSE4`
   >
   > `save config`

   **Important Note** - The value of the "`peer`" parameter **must** be the same as the name of the interoperable object in SmartConsole that you configure in Part 3 below.

   See the [Gaia Administration Guide](https://support.checkpoint.com/product/73#q=Gaia%20Administration%20Guide&f-commonsource=C.%20Documentation) for your version.
3. Configure BGP Peers for each eBGP ASN.

   Example (refer to the "View configuration" example above):
   > `set bgp external remote-as 65476 on`
   >
   > `set bgp external remote-as 65476 peer 172.16.50.10 on`
   >
   > `set bgp external remote-as 65476 peer 172.16.50.10 multihop on`
   >
   > `set bgp external remote-as 65476 peer 172.16.60.10 on`
   >
   > `set bgp external remote-as 65476 peer 172.16.60.10 multihop on`
   >
   > `set bgp external remote-as 65476 peer 172.16.150.10 on`
   >
   > `set bgp external remote-as 65476 peer 172.16.150.10 multihop on`
   >
   > `set bgp external remote-as 65476 peer 172.16.160.10 on`
   >
   > `set bgp external remote-as 65476 peer 172.16.160.10 multihop on`
   >
   > `save config`

   **Important Notes:**
   * The value of the "`remote-as`" parameter is the value of the "`asn`" parameter for each endpoint that appears in the Microsoft configuration.

   * The value of the "`peer`" parameter is the value of the "`bgpAddress`" parameter for each endpoint that appears in the Microsoft configuration.

   * If this BGP configuration must use BGP ECMP, then also run:

     `set bgp ecmp on`

     `save config`
   * To allow the receiving of the routes from Microsoft endpoints, configure either a routemap or inbound route filters.

   * To allow the distribution of local routes to Microsoft endpoints, configure either a routemap or route redistribution.

   See the [Gaia Advanced Routing Administration Guide](https://support.checkpoint.com/product/73#q=Gaia%20Advanced%20Routing%20Administration%20Guide&f-commonsource=C.%20Documentation) for your version.

**Part 3 of 4 - In Check Point SmartConsole**

1. Connect with SmartConsole to the Security Management Server / Domain Management Server.

2. From the left navigation panel, click "**Gateways \& Servers**".

3. Double-click the Security Gateway object.

4. In the left tree, click "**Network Management**".

5. From the toolbar, click "**Get Interfaces** " \> "**Get Interfaces With Topology** " \> click "**Accept**".

6. Examine the interfaces.

   Example:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture08202410312122158.png)
7. Click **OK** to close the Security Gateway object.

8. For **each** Microsoft endpoint, create a new "**Interoperable Device**" object.

   1. In the **Name** field, you must enter the same string that you configured in Part 2 on the Security Gateway in the "`add vpn tunnel`" commands in the parameter "`peer`".

   2. In the **IPv4 Address** field, you must enter the public IP address of the Microsoft endpoint.

      Refer to the "View configuration" example above.
   3. Click **OK** to close the Interoperable Device object.

   Example:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture09202410312122289.png)
9. Create and configure a Star VPN Community:

   1. On the "**Gateways**" page:

      1. In the "**Center Gateways**" section, add each Interoperable Device object for the Microsoft endpoints.

      2. In the "**Satellite Gateways**" section, add the Check Point Security Gateway object.

      3. In the **VPN Domain** , configure an empty "**Group**" object for each VPN Peer.

      Example:

      ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture102024103121224510.png)
   2. On the "**Encryption**" page:

      Configure the same encryption settings as you configure in the Microsoft Entra portal for each link.

      Example:

      ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture112024103121231111.png)
   3. On the "**Tunnel Management**" page:

      1. **Optional:** In the "**Permanent Tunnels** " section, select the checkbox "**Set Permanent Tunnels**" and select the applicable option.

      2. In the "**VPN Tunnel Sharing** " section, select the option "**One VPN tunnel per Gateway pair**".

      Example:

      ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture122024103121232512.png)
   4. On the "**Shared Secret**" page:

      For each Interoperable Device, configure the same shared secret that you configured in the Microsoft Entra portal.

      Example:

      ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture132024103121234113.png)
   5. On the "**Advanced**" page:

      To send connections with the internal IP addresses towards Microsoft SSE, select "**Disable NAT inside the VPN community**".
   6. Click **OK** to close the Star VPN Community object.

10. From the left navigation panel, click "**Security Policies** " and in the top panel, click "**Access Control**".

11. Configure these Access Control rules:

    1. To allow BGP traffic between the Check Point Security Gateway and the BGP IP addresses of the Microsoft endpoints.

    2. To allow the actual traffic that will be routed to and from the Microsoft endpoints.

12. Install the Access Control policy on the Check Point Security Gateway.

**Part 4 of 4 - Verification**

1. Connect to the command line on the Check Point Security Gateway.

2. Log in to the Expert mode.

3. Make sure the Security Gateway established the VPN tunnels:

   `vpn tu tlist`

   Example:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture142024103121235914.png)
4. Make sure the Security Gateway established the BGP neigborship with BGP peers:

   `show bgp peers`

   Example:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture152024103121241715.png)
5. Make sure the Security Gateway learned and accepted the routes from the Microsoft SSE Gateways:

   `show route bgp`

   Example:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture162024103121242916.png)

   **Note** - The received routes will be based on what is configured in the Microsoft Entra portal in the "**Traffic profiles** " section of the relevant remote network. For example "`Microsoft 365`" will redistribute all Microsoft 365 IP address ranges to the Check Point Security Gateway over BGP.

   Example:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture172024103121244017.png)
6. Make sure the Security Gateway advertises its local networks to the Microsoft SSE Gateways:

   `show bgp peer <IP Address of Local Network> advertise`

   Example:

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk182799/Picture182024103121245218.png)
7. Make sure the connections from the internal networks (behind the Security Gateway go through the correct VPN tunnel.

   * Examine the Security Gateway logs in SmartConsole / SmartView.

   * Run the "`vpn tu conn`" command on the the Security Gateway.

### Related Documentation

* [Gaia Administration Guide](https://support.checkpoint.com/product/73#q=Gaia%20Administration%20Guide&f-commonsource=C.%20Documentation) for your version.

* [Gaia Advanced Routing Administration Guide](https://support.checkpoint.com/product/73#q=Gaia%20Advanced%20Routing%20Administration%20Guide&f-commonsource=C.%20Documentation) for your version.

* [Site to Site VPN Administration Guide](https://support.checkpoint.com/product/446#q=Site%20to%20Site%20VPN%20Administration%20Guide&f-commonsource=C.%20Documentation) for your version.

* [Command Line Interface (CLI) Reference Guide](https://support.checkpoint.com/product/73#q=Command%20Line%20Interface%20Reference%20Guide&f-commonsource=C.%20Documentation) for your version.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content