Connect a Check Point Security Gateway to a VPNGeek gateway with an IKEv2 VPN — an interoperable device, a VPN community, the encryption domain, and the access rule that permits the traffic.
This guide connects a network behind a Check Point Security Gateway to a VPNGeek gateway with an IKEv2 VPN. On Check Point the VPNGeek gateway is modelled as an interoperable device, joined with your gateway in a VPN community, and the traffic is permitted by an ordinary access rule. All configuration is done in SmartConsole and installed as policy.
Before you start
Collect these before you open SmartConsole. Most VPN failures on Check Point come from a mismatched encryption suite or a wrong encryption domain.
- A VPNGeek plan that includes IPsec Gateways, and admin access to the dashboard.
- SmartConsole access to a management server running R81 or newer, and a gateway with IPsec VPN enabled.
- A static public IP on the Check Point external interface.
- Non-overlapping subnets — for example 10.20.0.0/16 on the VPNGeek side and 192.168.30.0/24 behind Check Point.
1. Create the tunnel in VPNGeek
In the dashboard open Gateways > Tunnels and add a new site-to-site tunnel. Enter the Check Point external IP as the peer and the local/remote subnets. The dashboard returns the values you will mirror in the community's encryption suite:
gateway_address: 198.51.100.80 # VPNGeek gateway
local_subnet: 10.20.0.0/16 # VPNGeek side
remote_subnet: 192.168.30.0/24 # Check Point domain
ike_version: 2 # IKEv2
ike_enc: aes-256
ike_integrity: sha256
dh_group: 14 (2048)
esp_enc: aes-256
esp_integrity: sha256
psk: (shown once)
2. Create the interoperable device
In SmartConsole open the Object Explorer (Ctrl+E) and create New > More > Network Object > Interoperable Device. This object represents the VPNGeek gateway.
- Name: vpngeek-gw
- IPv4 address: 198.51.100.80 (the VPNGeek gateway)
- Under Topology, define the VPN domain manually as a network group containing 10.20.0.0/16 — this is the VPNGeek encryption domain.
3. Create the VPN community
Open Security Policies > Access Control > VPN Communities and add a Meshed community (a star also works). Add your Check Point gateway and the vpngeek-gw interoperable device as participants, then configure encryption.
- Shared Secret: enable and enter the PSK from step 1 for the vpngeek-gw peer.
- Encryption > IKE (Phase 1): IKEv2 only, AES-256, SHA-256, DH group 14.
- Encryption > IPsec (Phase 2): AES-256, SHA-256, PFS on with DH group 14.
Choose a custom encryption suite rather than a preset so the algorithms match the VPNGeek side exactly.
4. Add the access rule
The community defines encryption; an access rule still has to permit the traffic. In the Access Control policy add a rule whose VPN column references the new community.
Name: VPNGeek site-to-site
Source: CP_LAN (192.168.30.0/24)
Destination: VPNGeek_Net (10.20.0.0/16)
VPN: vpngeek-community # not "Any Traffic"
Services: Any
Action: Accept
# add a mirrored rule (source/destination swapped) for return traffic
5. Disable NAT for VPN traffic and install policy
Make sure the automatic outbound NAT does not translate traffic destined for the tunnel. Under the community's Advanced > NAT settings, enable Disable NAT inside the VPN community. Then install the policy on the gateway.
6. Verify the tunnel
From the VPNGeek dashboard the tunnel should reach ESTABLISHED within about 30 seconds after policy install. Confirm from the Check Point gateway CLI (expert mode) and from SmartConsole's Logs & Monitor > Tunnels:
vpn tu
# tunnel and community state, live
cpview
# detailed IKE negotiation for debugging
vpn debug ikeon
tail -f $FWDIR/log/ike.elg
# prove traffic flows from the LAN side
ping -I 192.168.30.1 10.20.0.1
Troubleshooting
Phase 1 never completes
Usually a PSK or IKE-suite mismatch, or the community still allows IKEv1. Confirm the community is IKEv2-only with AES-256 / SHA-256 / group 14, and that the shared secret matches. Check ike.elg for the exact reason.
Phase 1 up, phase 2 fails
Almost always an encryption-domain mismatch. The interoperable device's VPN domain must be exactly 10.20.0.0/16 and your gateway's domain exactly 192.168.30.0/24 — nothing wider.
Tunnel up but traffic dropped
Check the access rule references the VPN community (not "Any Traffic"), that a mirrored return rule exists, and that "Disable NAT inside the VPN community" is enabled.