> Source: [sk54060](https://support.checkpoint.com/results/sk/sk54060) # sk54060 - How to Set Up a Site-to-Site VPN with Check Point Gateways Managed by the same Management Server | Property | Value | |----------|-------| | Solution ID | sk54060 | | Date Created | 2010-09-14 | | Last Modified | 2020-09-07 | | Technical Level | General | ## Solution **For the most up to date information, refer to the "Working with Site-to-Site VPN" section of the [VPN R77 Versions Administration Guide](https://sc1.checkpoint.com/documents/R77/CP_R77_VPN_AdminGuide/html_frameset.htm).** Generating an Internal CA Certificate ------------------------------------- **To generate an internal CA certificate for your security gateway object:** 1. In the General Properties window of your Security Gateway, make sure the IPSec VPN checkbox is selected. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_11611280518.png) 2. Click **OK** . An internal CA certificate is created. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_21611280520.png) Setting up the VPN ------------------ **To set up the VPN:** 1. In the IPSec VPN tab in your SmartDashboard, right-click in the open area on the top panel and select: 'New Community \> Star'. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_31611280521.png) 2. A Star Community Properties dialog pops up. In the General page, enter your VPN community name: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_41611280522.png) 3. In the Center Gateways page, click: **Add** , select your local Check Point gateway object, and click **OK** . ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_51611280523.png) 4. In the Satellite Gateways page, click: **Add** , select the peer gateway object, and click **OK** . ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_61611280524.png) 5. In the 'Encryption \> Custom Encryption Suite Properties' page, you can change the Phase 1 and Phase 2 properties. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_71611280526.png) 6. In the Tunnel Management page you can define how to setup the tunnel. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/image011.jpg) **Note** - The recommended tunnel sharing method is: One VPN tunnel per subnet pair. This will share your network on either side of the VPN, and makes the Phase 2 negotiation smooth, and requires fewer tunnels to be created for the VPN. If you need to restrict access over the VPN, you can do that later through your security rulebase. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_81611280553.png) 7. Expand the Advanced Settings page and select: Advanced VPN Properties. Here, you can modify the more advanced settings regarding Phase 1 and 2. It is also a good idea to select: "Disable NAT inside the VPN community" so you can access resources behind your peer gateway using their real IP addresses, and vice versa. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_91611280556.png) 8. Click **OK** on the VPN community properties dialog to exit back to the SmartDashboard. Defining VPN Domains -------------------- You now need to define your VPN domains. If you have not already done so, create network objects to represent your local networks and the peer networks they will be sharing with you. **To define VPN domains:** 1. From the Network Objects tree, right-click on Networks and select Network to define a new network. In the following image, we are creating a network to represent our peer's internal network that they will be sharing with us: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_101611280559.png) 2. If you or your peer is sharing more than one network over the tunnel, create groups to represent each side's VPN domain. From the Network Objects tree, right-click on Groups, select Groups and then Simple Group... ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_111611280601.png) In this example, we are only sharing one network, so the group will only have one object included, but you can put as many networks in this group as you would like to share. **It is important not to add groups within a group as this can impact performance.** Make sure the group is "flat". Give your group a meaningful name such as: Local_VPN_Domain. Click **OK**once you have added all of your local networks and then repeat the procedure to create a group to represent your peer's shared networks. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_121611280602.png) ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_131611280605.png) Now you need to set the VPN domains for each of the gateways. 3. Open the properties for your local Check Point gateway object. Select the Topology menu. In the VPN Domain section, select "Manually defined", and from the drop-down list, select your Local VPN domain group object. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_141611280608.png) 4. Click **OK**to save the object. 5. Open the properties for the peer gateway and select the group/network that represents its VPN domain: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_151611280610.png) 6. Click **OK**to complete the peer gateway configuration. Creating a Rule for the Traffic ------------------------------- Now, you have both objects setup for VPN and you have defined your community. All that is left is to create a rule for the traffic. Here is where you should restrict access, if it is required. **To create a rule for the traffic:** 1. Decide where in your rule base you need to add your VPN access rule and right-click the number on the rule just above where you want it and select: Add Rule --\> Below. In this example, we are allowing any service across the tunnel in both directions. [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_161611280641.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_161611280641.png "Click the image to see it in full size in a new tab/window") **You should also explicitly set the VPN community in the VPN column on your rule.** 2. In the VPN column, right-click the Any Traffic icon and select: Edit Cell.... Select the: "Only connections encrypted in specific VPN Communities" option button and click **Add** . Select the VPN community created in the above steps and click **OK** and then **OK** again. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_171611280613.png) Your rule should now show the VPN community in the VPN column. [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_181611280616.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk54060/sk54060_181611280616.png "Click the image to see it in full size in a new tab/window") Completing the Procedure ------------------------ Install the policy to your local Check Point gateway. The VPN is setup! Verifying the Procedure ----------------------- Once the remote side has setup their VPN to match, verify that you have secure communication with their site. **Related solutions:** * [sk108600 - VPN Site-to-Site with 3rd party](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108600) * [sk33331 - Configuring Site-to-Site VPN between VPN-1 Power/UTM and a (locally managed) VPN-1 UTM Edge or Safe@ with DAIP](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk33331) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content