---
title: "Configuring Check Point Redundant IPsec Tunnel"
slug: "configuring-check-point-redundant-ipsec-tunnel"
updated: 2026-04-07T09:02:12Z
published: 2026-04-07T09:02:12Z
canonical: "support.perimeter81.com/configuring-check-point-redundant-ipsec-tunnel"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.perimeter81.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Check Point Redundant IPsec Tunnel

<meta charset="utf-8">

## Introduction

This topic explains how to establish a single Site-to-Site VPN tunnel between your Check Point SASE Network and Check Point Firewall.

## Pre-requisites

- Check Point SASE Administrator Portal account.
- Device with Check Point SASE Agent installed.
- Administrator account with Firewall, Router, and the Cloud Management Portal.
- A cluster of two Quantum gateways, each with a public IP.
- Configuration with ISP redundancy PMTR-68991 is not supported.

## Part 1 - Configuration in SmartConsole

### Step 1: Creating Interoperable Device Object in the Check Point SmartConsole

1. Log in to the Check Point SmartConsole.
2. Click **Security Policies**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719204743016.png)
3. In the Objects pane, click **New** and select **More** > **Network Object**> **More** > **Interoperable Device**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719204770593.png)  
The**Interoperable Device** window appears.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719204889451.png)
4. In the **Name** field, enter a name for the Check Point SASE gateway, for example, *Harmony_SASE_Gateway*.
5. In the **IPv4 Address** field, enter the Check Point SASE gateway public IP address.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719205033828.png)To find the Check Point SASE Gateway public IP Address:
  1. Access the Check Point SASE Administrator Portal and click **Networks**.
  2. Select the network.
  3. Go to the **Gateways** section to find the Public IP address for setting up the single IPsec tunnel.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719205046690.png)
6. Click **OK**.
7. Click ![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1747980785401.png) on the left top corner of the page.
8. Select **Global properties**.
9. Go to **V****PN**> **Advanced**.
10. Select the **Enable VPN Directional Match in VPN Column**checkbox.
11. Click **OK**.
12. Select the cluster from the table.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1747980819744.png)
13. Click **General Properties**.
14. Select the **IPSec VPN** checkbox.
15. Click **Network Management**.
16. Click **Get Interfaces**.
17. Select **Get Interfaces With Topology**.  
The **SmartConsole** window appears.
18. Click **Yes**.
19. Double-click the Cluster Member 1.
20. In the **IPv4 Address** field, enter the Check Point SASE gateway public IP address.
21. To find the Check Point SASE Gateway public IP Address:
  1. Access the Check Point SASE Administrator Portal and click **Networks**.
  2. Select the network.
  3. Go to the **Gateways**section to find the Public IP address for setting up the single **IPsec tunnel**.
22. Click **Modify**.
23. In the **Anti-Spoofing** section, unselect the **Perform Anti-Spoofing based on interface topology** checkbox.
24. Click **OK**.
25. Click **OK**.
26. Repeat step from**p** through**u** for Cluster Member 2.
27. Go to **IPSec VPN** > **Link Selection**.
28. Select the **Statically NATed IP** checkbox and enter the Check Point SASE gateway public IP address.
29. Click **Source IP address settings**.  
The **Link Selection - Source IP Address Settings**window appears.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1747981044974.png)
30. Select **Manual**and then select **Selected address from topology table** checkbox.
31. From the list, select the private IP address.
32. Click **OK**.
33. Click **OK**.
34. Publish and install the policy.

<meta charset="utf-8">

### Step 2: Adding Check Point SASE Gateway IP Address and Remote Subnet To The Interoperable Device Object

1. Log in to the Check Point SASE Administrator Portal.
2. Click **Networks**.
3. Verify the assigned network:
  1. Select a network, scroll to the end of the row and click![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719207416268.png).
  2. Select **Edit Network**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719205365415.png)
  3. In the **Edit Network** section, check the **Subnet** field to verify the assigned network. The default value is 10.255.0.0/16.  
**![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719205400837.png)**
4. Open the Interoperable Device object that you created.
5. Click **Topology** > **New**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719205506418.png)
6. In the **General**tab, enter these:
  1. **Name** – Name of the topology, for example, *Check Point SASE Network*.
  2. **IP Address** – 10.255.0.0
  3. **Net Mask**– 255.255.0.0

![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719205577578.png)
7. In the **Topology** tab, select **Internal (leads to the local network)** and then select **Network defined by the interface IP and Net Mask**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719205654391.png)Note:

If the gateway is configured with an interface topology that includes a network range or a group overlapping with the encryption domain of the remote VPN peer, incoming decrypted traffic may be seen as coming from the wrong interface. This could trigger anti-spoofing measures, causing traffic to be dropped. To create an anti-spoofing exception, see [sk151774](https://support.checkpoint.com/results/sk/sk157074).
8. Click **OK**.
9. In the **VPN Domain**section, select **User defined** and click <v:shapetype coordsize="21600,21600" filled="f" id="_x0000_t75" o:preferrelative="t" o:spt="75" path="m@4@5l@4@11@9@11@9@5xe" stroked="f"><img src="https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1724656047129.png" class="fr-fic fr-dii fr-draggable">. <v:stroke joinstyle="miter">&nbsp; <v:formulas>&nbsp; <v:f eqn="if lineDrawn pixelLineWidth 0">&nbsp; <v:f eqn="sum @0 1 0">&nbsp; <v:f eqn="sum 0 0 @1">&nbsp; <v:f eqn="prod @2 1 2">&nbsp; <v:f eqn="prod @3 21600 pixelWidth">&nbsp; <v:f eqn="prod @3 21600 pixelHeight">&nbsp; <v:f eqn="sum @0 0 1">&nbsp; <v:f eqn="prod @6 1 2">&nbsp; <v:f eqn="prod @7 21600 pixelWidth">&nbsp; <v:f eqn="sum @8 21600 0">&nbsp; <v:f eqn="prod @7 21600 pixelHeight">&nbsp; <v:f eqn="sum @10 21600 0">&nbsp;</v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:f></v:formulas> <v:path gradientshapeok="t" o:connecttype="rect" o:extrusionok="f">&nbsp;</v:path></v:stroke></v:shapetype>.
10. Click **New** and go to **Group** > **Simple****Group**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/SimpleGroup.png)  
The **New Network Group** window appears.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/NewNetworkGroup.png)
11. In the **Enter Object Comment** field, enter a name, for example, HSASE_VTI, and click **OK**.
12. For the other Check Point SASE Gateway and Check Point Gateway, follow the same procedure in **Creating Interoperable Device Objects in the Check Point SmartConsole** and **Adding Check Point SASE Gateway IP Address and Remote Subnet To The Interoperable Device Object** sections.
13. Publish and install the policy.

### Step 3: Creating VPN Star community

1. Log in to the Check Point SmartConsole.
2. Click **Security Policies**.
3. Go to **Access Tools** > **VPN Communities**.
4. Select an object, click **New** and go to **More** > **VPN Community** > **Star Community**.  
The **New Star Community** window appears.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Link-Selection(3).png)
5. In the **Enter Object Name** field, enter an object name for the VPN Star Community, for example, *Harmony_SASE_VPN*.
6. In the **Link Selection Mode**section, select one of these:
  - **Enhanced (Recommended)**- Uses dynamic, intelligent, probe-based logic to choose the optimal VPN link. It evaluates:
    - Interface status
    - Multiple external IP addresses
    - Multiple ISP circuits
    - Reachability through Next-Hop Probing
    - SLA-like behavior for tunnel selection
  - **Legacy**- Uses static or basic logic to select the VPN interface or IP address. Selection is based on:
    - Main IP (default)
    - Selected interface
    - Selected IP
    - IP address determined by topology
7. In the **Centre Gateways** section, click ![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719206404291.png) and add the Check Point Gateway.  
The cluster is added to the table.
  1. Double-click the cluster in the table.
  2. In the **VPN Domain** section, select the **Override** checkbox and from the list, select the allow all VPN group.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1747981866213.png)
  3. In the **Interfaces**section, select the **Override** checkbox and click ![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1747981699328.png).  
The **Interface Settings**window appears.
  4. Specify these:
    1. **External Interface**
    2. **Static NAT IP Address**- The Check Point SASE gateway public IP address.
  5. Click **OK**.
  6. Click **OK**.
8. In the **Satellite Gateways** section, click ![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719206404291.png) and add the Interoperable Device Object created for the Check Point Gateway. See [Step 1](/v1/docs/configuring-check-point-redundant-ipsec-tunnel#step-1-creating-interoperable-device-object-in-the-check-point-smartconsole).
  1. From the table, double-click the cluster of the first Quantum Gateway.
  2. In the **VPN Domain** section, select the **Override** checkbox and from the list, select the allow all VPN group.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1747984165000.png)
  3. In the **Interfaces**section, select the **Override** checkbox and click ![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1747984244726.png).  
The **Interface Settings** window appears.
  4. Specify these:
    1. **External Interface**
    2. **Static NAT IP Address**- The Check Point SASE gateway public IP address.
  5. Click **OK**.
  6. Click **O****K**.
  7. Repeat the steps from **a** through **f** for the cluster of the second Quantum Gateway.
9. Go to **Shared Secret**and click![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719206470575.png) to edit the shared key.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Image5(1).png)
10. In the **Enter secret**field, enter an appropriate key.Notes:

  - Check Point recommends that the shared secret key is at least 20 characters in length.
  - Copy the key as it is required while configuring the IPsec Tunnel in the Check Point SASE Administrator Portal.

![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719207148308.png)
11. Click **OK**.
12. From the left navigation pane, click **Encryption**and do these:
  1. In the **Encryption Settings** section, from the **Encryption Method**list, select**IKEv2 only**.
  2. In the **Encryption Suite**section, select **Custom encryption suite**.
  3. In the **IKE Security Association (Phase 1)**section:
    1. From the **Encryption Algorithm** list, select **AES-256**.
    2. From the **Data Integrity** list, select **SHA256**.
    3. From the **Diffie Hellman group** list, select **Group 14 (2048 bit)**.
  4. In the **IKE Security Association (Phase 2)**section:
    1. From the **Encryption Algorithm** list, select **AES-256**.
    2. From the **Data Integrity** list, select **SHA256**.
    3. Select **Use Perfect Forward Secrecy**.
    4. From the **Diffie Hellman group** list, select **Group 14 (2048 bit)**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Image6.png)
13. Go to **Tunnel Management**.
14. In the **Permanent Tunnels** section, select the **Set Permanent Tunnels** checkbox and then select **On all tunnels in the community**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/PermanentTunnels(2).png)
15. In the **VPN Tunnel Sharing**section, select **One VPN tunnel per Gateway pair**.  
Note:Make sure that you enter the remote subnets specified here in the Check Point SASE Administrator Portal. A mismatch can disconnect the tunnel.
16. Go to **Advanced**.
17. In the **IKE (Phase 1)** section, set the **Renegotiate IKE security associations every (minutes)** field to **480**.
18. In the **IPsec (Phase 2)** section, set the **Renegotiate IPsec security associations every (seconds)** field to **3600**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719207064571.png)
19. Click **OK**.
20. In the **Properties**section, select the **Disable NAT inside the VPN community**checkbox and from the list, select **Both center and satellite**gateways.
21. Repeat the above steps for the other Check Point Gateway and Check Point SASE Gateway.
22. Publish and install the policy.

### Step 4: Additional settings in Check Point SmartConsole

1. To set up a Check Point firewall policy, add a rule for VPN traffic for the specific VPN Domain in the Check Point SmartConsole.

In the example below, we have created a policy to allow traffic from the Check Point SASE Network 10.255.0.0/16 to specific destinations and services. Note that the network configuration may differ if you have not changed the default settings during Check Point SASE network creation. For testing purposes, you should initially allow any/any or allow before making the firewall policy more restrictive.

Note:The network configuration differs if you have not changed the default settings during Check Point SASE network creation. For testing purposes, you should initially allow any/any or allow ping before making the firewall policy more restrictive.

![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719207316980.png)
2. Publish and install the policy.

### Step 5: Configuring VPN Tunnel Interface and BGP Configuration

1. Log in to the Check Point Gaia Portal of the first Check Point Gateway.
2. Click **Network Interfaces.**
3. From the**Add**list, select**VPN Tunnel**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Step5-3.png)The**Add VPN Tunnel**page appears.
4. Enter these:
  1. **VPN Tunnel ID** - Select a unique ID.
  2. **Peer**- Name of the interoperable device previously created for the first Check Point SASE Gateway.
  3. **VPN Tunnel Type** - Numbered
  4. **Local Address** - Internal address for the Quantum Gateway (within 169.254.x.x/30 ranges).
  5. **Remote Address** - Internal address for the Check Point SASE Gateway (within 169.254.x.x/30 ranges, corresponding to the above).
5. Click **OK**.
6. Click **Network Interfaces,****Add > Loopback.****![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Step5-6.png)**
7. Select **Use the following IPV4 address**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Step5-7.png)
8. In the **IPv4** field, enter the **Local Address** entered in step 4 and click **OK**.
9. Go to **Advanced Routing** and select **BGP**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Step5-9.png)
10. In the **Peer Groups** section, click **Add**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Step5-10.png)
11. Enter these:
  1. **Peer AS Number** - The AS Number of the Check Point SASE network. If not set already, enter 64512.
  2. **Peer Group Type** - External
  3. **Local Address** - The local address entered in the VTI configuration section step 4.
12. Click **Add Peers.**
13. Enter these:  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Step5-13.png)
  1. In the **Peer** field, enter the Remote Address set under the VTI configuration in step 4 and click **Show Advanced Settings**.**![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Step5-14.png)**
  2. Select the **Graceful Restart** checkbox.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Step-15.png)
  3. Select the **eBGP Multihop**checkbox and click **Save**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/eBGPMultihop.png)Note:Without Multihop enabled, the BGP session cannot be established.
14. From the **View mode**list, select **Advanced Routing** and click **Inbound Route Filter.**
15. From the**Add**list**,**select **Add BGP Policy Filter (Based on AS)**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Step5-AddBGPPolicy.png)The **Add BGP Policy Filter based on AS**window appears.
16. Specify these:
  1. **Add BGP Policy** - Set a number from the available range
  2. **AS Number** - Set the AS Number of the Check Point SASE Network
  3. **Action** - Accept**![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Step5-16.png)**
17. Click **Save**.
18. From the **View mode**list, select **Advanced Routing**, click **Route Redistribution.****![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/RouteRedistribution.png)**
19. From the list, select **Add Redistribution From.****![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/AddRedistributionForm.png)**
20. Select**Static.**
21. Click**Save.**Note:For BGP, no routes are accepted from a peer by default. You must configure an explicit Inbound BGP Route Filter to accept a BGP route from a peer.
22. Repeat the steps for the second Check Point Gateway and Check Point SASE Gateway. Use a different **1****69.254.x.x/30** range for the local and remote peer IP addresses.

## Part 2 - Configuration in Check Point SASE Administrator Portal

### Step 1 : Configuring Tunnel and Routes Table

1. Access the Check Point SASE Administrator Portal and click **Networks**.![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Screen%20Shot%202021-02-17%20at%2019.31.14(2).png)
2. Select the network.
3. Click ![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719207416268.png).
4. Select **Add Tunnel**for the gateway from which you want to add the IPSec Site-2-Site VPN tunnel.
  1. Click **IPSec Site-2-Site Tunnel** and click **Continue**.![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Screen%20Shot%202022-06-02%20at%205.56.11%20PM.png)
  2. Click **Redundant****Tunnels**and****click**Continue.**  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Screen%20Shot%202022-06-02%20at%205.57.33%20PM.png)
  3. In the **Tunnel name** field, enter a logical name.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/RedundantIPSecTunnels.png)
  4. Expand **Tunnel 1**and specify these:
    - **Shared Secret** – The value previously set on the first star policy.
    - **Check Point SASE Gateway Internal IP** - The remote address of the first Check Point Gateway used under the VTI settings.
    - **Remote Public IP** - The public IP of the first Quantum Gateway.
    - **Remote Gateway Internal IP** -The local address of the first Quantum Gateway used under the VTI settings.
    - **Remote Gateways ASN** - The ASN of the first Quantum Gateway.
    - **Remote ID** - The router ID of the first Quantum Gateway used under the BGP settings above.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/CPHQ01.png)
  5. Expand **Tunnel 2**and specify these:
    - **Gateway** - Select the second Check Point SASE Gateway for the tunnel.
    - **Shared Secret** - The value previously set on the second star policy.
    - **Check Point SASE Gateway Internal IP** - The remote address of the second Quantum Gateway used under the VTI settings.
    - **Remote Public IP** - The public IP of the second Quantum Gateway.
    - **Remote Gateway Internal IP** -The local address of the second Quantum Gateway used under the VTI settings.
    - **Remote Gateways ASN** - The ASN of the second Quantum Gateway.
    - **Remote ID** - The router ID of the second Quantum Gateway used under the BGP settings above.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/CPHQ02.png)
  6. Expand **Shared Settings**and specify these:
    - **Check Point SASE Gateway Proposal Subnets**- Leave **Any (0.0.0.0/0)**selected.
    - **Remote Gateway Proposal Subnets** - Leave **Any (0.0.0.0/0)**selected.
    - **Autonomous System Number (ASN) -**Default value is **64512**, if not set, enter the AS Number for the Check Point SASE network.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/SharedSetting_Any_Any.PNG)
  7. In the **Advanced Settings** section, specify these:  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/KeyExchangeMethod(1).PNG)
    - **IKE Version:** V2
    - **IKE Lifetime:** 8h
    - **Tunnel Lifetime:** 1h
    - **Dead Peer Detection Delay:** 10s
    - **Dead Peer Detection Timeout:** 30s
    - **Phase 1**:
      - **Encryption****(Phase 1):** aes256
      - **Integrity (Phase 1):** sha256
      - **Key Exchange Method****:** modp2048
    - **Phase 2**:
      - **Encryption****(Phase 2):** aes256
      - **Integrity (Phase 2):** sha256
      - **Key Exchange Method****:** modp2048
  8. Click **Add Tunnel**.
5. Select **Routes Table**:![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Pasted_Image_6_6_22__4_18_PM.png)
  1. Click **Add Route.**  
**T**he **Add Route** window appears.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/image-1719207709320.png)
  2. Enter all the subnets on the remote side of the tunnel and then click **Add Route**.Note:Make sure that in the Tunnel list, you have selected the previously entered Tunnel name.
6. Click **Apply Configuration**.  
![](https://cdn.document360.io/44667c0c-50d7-412a-acbd-20d4a41c952e/Images/Documentation/Screen_Shot_2022-06-06_at_4_20_58_PM.png)

### Step 2: Verifying the Setup

Once you complete the above steps, your tunnel should be active.

1. Verify the setup in the Check Point SASE Administrator Portal:
  1. Click **Networks**.
  2. Locate the tunnel you created, and check the tunnel status.  
It should indicate that the tunnel is **Up**, signifying a successful connection.
2. Verify the setup in the Check Point SASE Agent:
  1. Connect to your network using the Check Point SASE Agent.
  2. Access one of the resources in your environment.

## Troubleshooting

If you encounter issues during or after the setup, review your settings to ensure everything matches the instructions. Check the IP addresses and other details you entered during setup. If issues persist, please consult our dedicated support.

## Support Contacts

If you have any difficulties or questions, contact Check Point SASE's support team. We offer 24/7 chat support on our website at [sase.checkpoint.com](https://www.sase.checkpoint.com/), or you can email us at sase-support@checkpoint.com.