--- title: "Setting up site-to-site on Check Point" slug: "site-to-site-check-point" description: "Make sure you have the IP of your NordLayer dedicated server.Add a shared secret that contains at least 20 characters.Set VPN Tunnel Sharing to One VPN tunnel per Gateway pair." status: "update" updated: 2026-09-08T13:11:25Z published: 2026-09-08T13:11:25Z canonical: "help.nordlayer.com/site-to-site-check-point" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.nordlayer.com/llms.txt > Use this file to discover all available pages before exploring further. # Setting up site-to-site on Check Point **Note**: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead. ## Creating a gateway object at the Check Point Smart Console 1. Open the Check Point Smart Console 2. Go to Security Policies 3. Add NordLayer Private Gateway as an object as shown in the image below. Please make sure you have the IP of your NordLayer server with a dedicated IP ![Check Point SmartConsole interoperable device configuration menu with network object categories](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/01%20Setting%20up%20site-to-site%20on%20Check%20Point(1).png){height="" width=""} ![Check Point interoperable device properties with NordLayer name and IP configuration](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/02%20Setting%20up%20site-to-site%20on%20Check%20Point(1).png){height="" width=""} ## Creating a VPN Star community 1. Create a new Star Community ![Check Point VPN community encryption settings with center and satellite gateway configuration](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/03%20site-to-site-check-point(1).webp){height="" width=""} 2. Fill in the following information: * Specify an **Object Name** of your own choice * Add your **NordLayer gateway** as **Center Gateway** * Add your **external Firewall IP** as **Satellite Gateways** 3. Go to **Shared Secret** 4. Add a **Shared Secret** and write it down as we will also need this value on our end. Please note: Check Point recommends choosing a shared secret that contains at least 20 characters ![Check Point VPN shared secret configuration for NordLayer peer authentication](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/04%20Setting%20up%20site-to-site%20on%20Check%20Point(1).png){height="" width=""} 5. Go to **Encryption** and set **IKE Security** ![Check Point NordLayer VPN encryption settings with IKE Phase 1 and 2 configurations](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/site-to-site-check-point(1).webp){height="" width=""} 6. Go to **Tunnel Management** 7. Set **VPN Tunnel Sharing** to **One VPN tunnel per Gateway pair** ![Check Point NordLayer VPN tunnel management with permanent tunnels and sharing options](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/06%20site-to-site-check-point(1).webp){height="" width=""} 8. Select OK ## Additional settings at the Check Point Smart Console 1. Under Check Point firewall policy, add a rule for any to any, in and out to 10.6.0.0/20 2. Create a Network group with All local networks to be trusted with the VPN tunnels ![Check Point Network Group selector with LAN objects filtered and highlighted](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/07%20Setting%20up%20site-to-site%20on%20Check%20Point(1).png){height="" width=""} ## Adding the NordLayer gateway IP and remote subnet 1. Open the NordLayer object you created 2. Go to Topology 3. Select New at the top 4. Under the General tab, fill in Name, IP Address, and Net Mask 5. Add NordLayer remote subnet 10.6.0.0 as IP Address 6. Add "255.255.240.0" as Net Mask ![Check Point interface properties showing IPv4 address and netmask configuration for NordLayer](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/08%20Setting%20up%20site-to-site%20on%20Check%20Point(1).png){height="" width=""} 7. Open the Topology tab. Select Network defined by the interface IP and Net Mask ![Check Point interface topology settings with internal network and IP address options](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/09%20Setting%20up%20site-to-site%20on%20Check%20Point(1).png){height="" width=""} 8. Select OK 9. Go to Topology 10. Select New at the top 11. Under the General tab, fill in Name, IP Address, and Net Mask 12. Add the IP of your NordLayer gateway xxx.xxx.xxx.xxx as IP Address 13. Add "255.255.255.255" as Net Mask 14. Open the Topology tab. Select External (leads out to the internet) 15. Select OK 16. Publish and Install Policy ## Ending note: In order to finalize the site-to-site tunnel, please create a setup in [Sites tab of the NordLayer Control Panel](/v1/docs/site-to-site). * Pre-shared key - you can generate it or we can provide it * Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2) * Remote gateway/router public IP (must be reachable while connected to the dedicated server) * Remote subnet and mask (the subnet is used in your local network) *** **Note**: In case you have any questions or issues, press '**Chat with support**' at the bottom of the page.