Dynamic IP Tunnels

Use a dynamic IP tunnel when the public IP address of your on-premises firewall or router can change. Configure the tunnel in Check Point SASE, and then configure the peer.

IPsec Site-to-Site Tunnel

In the Check Point SASE tunnel configuration:

  1. In the peer public IP address field, enter 0.0.0.0
  2. In the Remote ID or Site ID field, enter the identity configured on the peer
  3. Select IKEv2
  4. Complete the remaining settings as described in Configuring the Tunnel in the Check Point SASE Administrator Portal.

To configure the peer, see Integrating On-premises Firewall / Router or Cloud based Resources. Select the guide for your firewall or router. If the peer has a dynamically assigned IP address (DAIP), follow the dynamic IP instructions for that device.

WireGuard Connector Tunnel

When you Configuring a WireGuard Connector Tunnel, enter 0.0.0.0 in the Endpoint field if the connector uses a dynamic public IP address. Complete the connector installation and verification procedures in that guide.

WireGuard Connector tunnels support Standard Networks only.

Warning:
Dynamic IP tunnels are not supported by cloud Infrastructure as a Service (IaaS) providers, such as AWS, GCP, or Azure. Each Cloud Gateway supports only one dynamic IP IPsec tunnel.