I am not familiar with Checkpoint Secure Server. Does it run on NT or W2k. If it does then yes you need to add a static route in the OS not in FW1.