Home
How-To and Troubleshooting References
Configuring Active-Standby BGP for Site-to-Site Through SASE (Quantum and Maestro)
This procedure explains when and how to configure active-standby BGP for site-to-site traffic through redundant VTI tunnels with SASE and Maestro deployments. It also describes prerequisites and primary-region selection considerations.
Step 5 - Save the Configuration
This task explains how to save the configuration and provides important notes about route maps and AS prepend configuration.

Important Information
Introduction to Check Point SASE
Getting Started
Migrating the SASE (Perimeter 81) Workspace to Check Point Portal
Dashboard
Team
Devices
Networks
Private Access
Internet Access
Threat Prevention Policy
Data Loss Prevention
SaaS API
Enterprise Browser
Monitor & Logs
Objects
Settings
Using Model Context Protocol (MCP) Server with SASE
Managed Service Providers
How-To and Troubleshooting References
- Troubleshooting Connectivity Issues with the Check Point SASE Agent
- Changing DNS Settings in Windows
- Changing DNS Settings in Mac
- Changing Region and Language for Accurate Google Search Results
- Generating an HTTP Archive (.HAR) File
- Troubleshooting Common Errors in IPsec Site-to-Site Connection Setup
- Configuring Active-Standby BGP for Site-to-Site Through SASE (Quantum and Maestro)
  This procedure explains when and how to configure active-standby BGP for site-to-site traffic through redundant VTI tunnels with SASE and Maestro deployments. It also describes prerequisites and primary-region selection considerations.
  - BGP Configuration in Gaia Clish
    Configure BGP settings in Gaia Clish by defining placeholders, AS information, and router ID values.
  - Step 2 - Configure Inbound Route Maps
    Configure inbound route maps to prefer the primary region for return traffic. Set lower preference values for routes learned from the primary peer.
  - Step 3 - Configure Outbound Route Maps
    Configure outbound route maps to advertise the LAN and prepend the AS path on the secondary path. Set the matched protocol according to how the LAN prefix exists on the gateway.
  - Step 4 - Configure BGP Peering and Bindings
    This task explains how to configure BGP peering and route map bindings for primary and secondary peers. It includes the required commands for remote AS and peer configuration.
  - Step 5 - Save the Configuration
    This task explains how to save the configuration and provides important notes about route maps and AS prepend configuration.
  - Verify on the Gateway
    Verify BGP configuration, peer status, route advertisements, and failover behavior on the active cluster member.
  - Validated Example
    This example shows sample BGP configuration values and commands for a lab environment. Replace the sample values with values from your environment before deployment.
Release Notes

Step 5 - Save the Configuration

This task explains how to save the configuration and provides important notes about route maps and AS prepend configuration.

Run:

save config

Notes

The import route maps accept and rank the received routes. A separate inbound accept-all filter is not required.
The export route maps are the advertising mechanism. Do not also redistribute the LAN through a separate route-redistribution rule. This advertises the prefix a second time without the prepend and defeats the configuration.
Apply the AS prepend through the export route map. The peer-attribute form does not take effect and must not be used:
```
set bgp external remote-as <SASE_AS> peer <SECONDARY_PEER_VTI_IP> aspath-prepend-count <N>
```

15 September 2026