## IPSec Amazon without VTI

Site2Site VPN (Amazon - Company)

We're running a firewall cluster based on R77.30 and want to setup an IPsec VPN tunnel with Amazon VPC.

But there's a known issue with R77.30 and VTI's.  
See: [How to configure IPsec VPN tunnel between Check Point Security Gateway and Amazon Web Services VPC](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk100726&partition=General&product=IPSec)

If CoreXL is disabled we see a very High CPU usage.  
That's why we want to setup an IPSec without VTI's, instead of updating to R88.10 first.

When downloading the Configuration file from Amazon:
- Vendor: Generic  
- Platform: Generic  
- Software: Vendor Agnostic

Within the config file there's a part about the Inside IP Address

| The Customer Gateway inside IP address should be configured on your tunnel |  
| --- |  
| Outside IP Addresses: |  
| - Customer Gateway: a.b.c.d. |  
| - Virtual Private Gateway: z.y.x.w |  
| Inside IP Addresses |  
| - Customer Gateway: 169.254.22.106/30 |  
| - Virtual Private Gateway: 169.254.22.105/30 |

How can I configure the inside Customer Gateway and Inside Virtual Private Gateway without using VTI's?

The following SK article has been followed ([sk113840](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eventSubmit_doGoviewsolutiondetails=&solutionid=sk113840)).  
And: [Ensure VPN Tunnels Pass Traffic Between Customer Gateways and Virtual Private Gateways](https://aws.amazon.com/premiumsupport/knowledge-center/vpn-cgw-vpg-traffic/)

Please advise.

Regards,  
Ray

- Tags:
  
- [amazon](https://community.checkpoint.com/t5/tag/amazon/tg-p/board-id/sase)  
- [corexl](https://community.checkpoint.com/t5/tag/corexl/tg-p/board-id/sase)  
- [r77.30](https://community.checkpoint.com/t5/tag/r77.30/tg-p/board-id/sase)  
- [vpn](https://community.checkpoint.com/t5/tag/vpn/tg-p/board-id/sase)  
- [vti](https://community.checkpoint.com/t5/tag/vti/tg-p/board-id/sase)

---

**User Response**

It's generally less reliable to not use VTIs with Amazon.  
See: [link](https://community.checkpoint.com/message/14458-re-ipsec-tunnel-to-aws-vpc-sporadically-drops-after-p...)  
You really should consider upgrading to R80.x.