Why would an old Connectra Gateway IP be displayed to remote SSL Network Extender users, after changing it to a different IP? You must:

Wesley A.Apr 24, 2026

B is your answer. When you change the Connectra Gateway IP, the old IP is baked into the certificate, and until you update the certificate to reflect the new IP, SSL Network Extender clients will still see the old one because that is what the cert presents during the handshake.

Fatima Z.Apr 14, 2026

The cert is the culprit here, picture it as a name tag still pinned to the door of your OLD address. When you swap the IP but leave the old certificate in place, SNE clients read that stale name tag and still route to the ghost address, so updating the cert to B is your one true fix.

Imani T.Apr 14, 2026

B is the right call here, and once you understand why, it sticks. The SSL Network Extender is doing exactly what it should, reading the identity information baked into Connectra's certificate, and that cert still has the old IP embedded in it because you never reissued it after the change. D trips a lot of people up because yes, Check Point licenses are IP-bound and you would need a new license too, but the license has nothing to do with what gets displayed to the end user during the SSL handshake. Whoever wrote option C honestly should be embarrassed, because the method you use to change the IP has zero bearing on whether the certificate reflects it afterward.

Orla P.Apr 30, 2026

Cert ties to the old IP, so clients still see it until you reissue. Took me a second on test day but the word "certificate" in option B clicked fast once I remembered SNE pulls that address straight from the cert.

Bao N.Apr 16, 2026

Been grinding this domain for three weeks and D keeps making the most sense to me here. Check Point licenses are tied to the IP address of the gateway, so when you swap the IP, the old license is essentially still binding the system to that previous address, and the Extender clients end up pulling the identity baked into that license rather than the new one you configured. The gateway has no real reason to advertise the updated IP if the license is still anchored to the old one, because the licensing layer is what the system trusts as the authoritative source of its own identity. I know A looks tempting because a service restart seems like the quick fix people always try first, but that just clears cached states, it does not resolve the root mismatch between the configured IP and what the license says the gateway actually is. Putting in a fresh license keyed to the new IP forces the whole stack to reconcile around the correct address, which is exactly the behavior SSL Network Extender users would see reflected on their end.