If you really can't change the firewall rules on the checkpoint to merely allow ICMP echo requests to the firewalls interface on this subnet, then you need to set the following advanced HA parameters:
- Set das.usedefaultisolationaddress to false in order to disable using the default gateway for isolation checking.
- Set das.isolationaddress0 to a known available, pingable IP on the management network, for example a physical switch. You can also configure multiple IPs to check with das.isolationaddress1, das.isolationaddress2 etc.
See:
http://www.yellow-bricks.com/vmware-high-availability-deepdiv/