156-215.80 · Question #546
An administrator is creating an IPsec site-to-site VPN between his corporate office and branch office. Both offices are protected by Check Point Security Gateway managed by the same Security…
The correct answer is C. Certificate based Authentication is the only authentication method available between two. When both VPN gateways are managed by the same SMS, certificate-based authentication via the internal CA is enforced automatically, so no pre-shared secret input field is presented.
Question
An administrator is creating an IPsec site-to-site VPN between his corporate office and branch office. Both offices are protected by Check Point Security Gateway managed by the same Security Management Server (SMS). While configuring the VPN community to specify the pre- shared secret, the administrator did not find a box to input the pre-shared secret. Why does it not allow him to specify the pre-shared secret?
Options
- AThe Gateway is an SMB device
- BThe checkbox "Use only Shared Secret for all external members" is not checked
- CCertificate based Authentication is the only authentication method available between two
- DPre-shared secret is already configured in Global Properties
How the community answered
(66 responses)- A35% (23)
- B15% (10)
- C42% (28)
- D8% (5)
Why each option
When both VPN gateways are managed by the same SMS, certificate-based authentication via the internal CA is enforced automatically, so no pre-shared secret input field is presented.
Being an SMB device does not determine whether the pre-shared secret field appears; internally managed non-SMB gateways also use certificate-based authentication by default.
The 'Use only Shared Secret for all external members' checkbox governs externally managed peers; since both gateways here are internally managed by the same SMS, this option is irrelevant to the missing field.
Check Point Security Gateways managed by the same SMS are automatically provisioned with certificates from the internal Certificate Authority (ICA) during gateway initialization, making certificate-based authentication the only available and default method for VPN communities between them. Because the SMS can authenticate both gateways via ICA certificates without a shared secret, the pre-shared secret field is simply not offered - it only appears when at least one peer is an externally managed or third-party gateway.
Global Properties stores VPN-wide defaults such as IKE settings but does not hold or auto-populate a pre-shared secret that would cause the field to disappear from the VPN community dialog.
Concept tested: IPsec VPN certificate authentication for SMS-managed gateways
Source: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_VPN_AdminGuide/Topics-VPN/Site-to-Site-VPN-with-Pre-Shared-Secret.htm
Topics
Community Discussion
4
Ingrid P.Mar 15, 2026When both gateways are managed by the same SMS, Check Point automatically uses certificate-based authentication via IKE, and there is simply no option to enter a pre-shared secret because the SMS handles certificate trust between its own managed gateways. This is the card to make: "Same SMS, two gateways, no PSK option" paired with "SMS manages certificate trust automatically."
Bao N.Mar 14, 2026C is right, though calling it "the only method" is a bit strong since certs are just the default when both gateways share the same SMS.
Luis F.Mar 6, 2026Okay so I definitely clicked D first because I remembered something about Global Properties having PSK settings and I figured maybe it was just pre-filled somewhere else. But then I went back to the lab guide and it hit me, when both gateways are managed by the same SMS, the SMS is already acting as your internal CA and it issues certificates to both gateways automatically. So Check Point just does not give you the pre-shared secret option at all for internally managed gateways because certificate auth is the only method available in that topology. Pre-shared secret only shows up when you have an external member in the community, like a third-party device or a gateway outside your SMS control, which is also why option B kind of makes sense as a trap if you do not know that detail. Glad I caught it before test day.
Bao N.Mar 7, 2026That detail about the PSK option literally graying out in SmartConsole when both gateways are internally managed is what makes this question a good one, because you have to know it disappears at the UI level, not just at the conceptual level.