Home
How-To and Troubleshooting References
Configuring Active-Standby BGP for Site-to-Site Through SASE (Quantum and Maestro)
This procedure explains when and how to configure active-standby BGP for site-to-site traffic through redundant VTI tunnels with SASE and Maestro deployments. It also describes prerequisites and primary-region selection considerations.
BGP Configuration in Gaia Clish
Configure BGP settings in Gaia Clish by defining placeholders, AS information, and router ID values.

Important Information
Introduction to Check Point SASE
Getting Started
Migrating the SASE (Perimeter 81) Workspace to Check Point Portal
Dashboard
Team
Devices
Networks
Private Access
Internet Access
Threat Prevention Policy
Data Loss Prevention
SaaS API
Enterprise Browser
Monitor & Logs
Objects
Settings
Using Model Context Protocol (MCP) Server with SASE
Managed Service Providers
How-To and Troubleshooting References
- Troubleshooting Connectivity Issues with the Check Point SASE Agent
- Changing DNS Settings in Windows
- Changing DNS Settings in Mac
- Changing Region and Language for Accurate Google Search Results
- Generating an HTTP Archive (.HAR) File
- Troubleshooting Common Errors in IPsec Site-to-Site Connection Setup
- Configuring Active-Standby BGP for Site-to-Site Through SASE (Quantum and Maestro)
  This procedure explains when and how to configure active-standby BGP for site-to-site traffic through redundant VTI tunnels with SASE and Maestro deployments. It also describes prerequisites and primary-region selection considerations.
  - BGP Configuration in Gaia Clish
    Configure BGP settings in Gaia Clish by defining placeholders, AS information, and router ID values.
  - Step 2 - Configure Inbound Route Maps
    Configure inbound route maps to prefer the primary region for return traffic. Set lower preference values for routes learned from the primary peer.
  - Step 3 - Configure Outbound Route Maps
    Configure outbound route maps to advertise the LAN and prepend the AS path on the secondary path. Set the matched protocol according to how the LAN prefix exists on the gateway.
  - Step 4 - Configure BGP Peering and Bindings
    This task explains how to configure BGP peering and route map bindings for primary and secondary peers. It includes the required commands for remote AS and peer configuration.
  - Step 5 - Save the Configuration
    This task explains how to save the configuration and provides important notes about route maps and AS prepend configuration.
  - Verify on the Gateway
    Verify BGP configuration, peer status, route advertisements, and failover behavior on the active cluster member.
  - Validated Example
    This example shows sample BGP configuration values and commands for a lab environment. Replace the sample values with values from your environment before deployment.
Release Notes

BGP Configuration in Gaia Clish

Configure BGP settings in Gaia Clish by defining placeholders, AS information, and router ID values.

Enter the commands in Gaia Clish, and then run save config. On a cluster, enter the commands identically on both members.

Placeholders:

<LOCAL_AS>: This gateway's AS
<ROUTER_ID>: Router ID
<SASE_AS>: SASE AS. The default value is 64512
<PRIMARY_PEER_VTI_IP> and <SECONDARY_PEER_VTI_IP>: VTI remote addresses of the primary and secondary regions
<LAN_PREFIX>: Internal subnet to advertise
<N>: Prepend count

Step 1 - Configure the AS Number and Router ID

Run:

Configure the AS number and router ID.

set as <LOCAL_AS>
                        set router-id <ROUTER_ID>

15 September 2026