topic Re: Encryption Domain with Exclusion Group in Firewall and Security Management

Encryption Domain with Exclusion Group

Evan_Fisher — Thu, 06 Feb 2020 15:17:36 GMT

Is it possible to use an exclusion group as part of a VPN encryption domain? Or do I have to list out all the network objects that I want and not include the ones I don't want?

Thanks!

Re: Encryption Domain with Exclusion Group

KennyManrique — Thu, 06 Feb 2020 16:02:33 GMT

I did for one customer whose internal subnet had another devices reachable without VPN (Switches and Routers). On my case, excluding only the hosts (ex. Remote Domain Net 192.168.1.0/24, excluding 192.168.1.2 and 192.168.1.3) It worked without issues.

Re: Encryption Domain with Exclusion Group

Evan_Fisher — Thu, 06 Feb 2020 16:14:38 GMT

And you used an exclusion group? Object Explorer -> Network Objects -> Groups -> Group with Exclusions ?

Re: Encryption Domain with Exclusion Group

KennyManrique — Thu, 06 Feb 2020 19:43:53 GMT

Yes. I configured the exclusion group as encryption domain.

Even worked excluding the external IP of remote gateway, so this way, was not included on encryption domain automatically.

Re: Encryption Domain with Exclusion Group

Wolfgang — Thu, 06 Feb 2020 20:17:35 GMT

Evan,

as @KennyManrique mentioned, it is no problem to use a group with exclusions as encryption domain.

I think 80% of our customers are doing this.

Wolfgang

Re: Encryption Domain with Exclusion Group

Maarten_Sjouw — Thu, 06 Feb 2020 21:51:23 GMT

We did use it also, but found some weird behavior with it, it stopped working based on Network to Network and started working with host based tunnels instead.
Must say this was with R77.30 gateways.

Re: Encryption Domain with Exclusion Group

Timothy_Hall — Sun, 09 Feb 2020 15:53:20 GMT

Yes, depending on the size of the excluded hosts/networks it may cause a change in behavior for the size of the subnets proposed in IKE Phase 2, particularly when hosts (/32) are excluded. When exclusions are used, the VPN domain is recalculated into multiple networks/subnets to exclude the desired addresses. You can use tools like Danny Jung's VPN Domain One-liner to see this in action:

https://community.checkpoint.com/t5/Enterprise-Appliances-and-Gaia/One-liner-to-show-VPN-topology-on-gateways/m-p/57975

Re: Encryption Domain with Exclusion Group

Danny — Sun, 09 Feb 2020 16:33:15 GMT

Groups with exclusions have many limitations one should be aware of. (sk97246, sk101506, sk107543, sk107417, ..)

I've also mentioned this in my article about Properly defining the Internet within a security policy.

Re: Encryption Domain with Exclusion Group

Nikolaos_Liakop — Mon, 08 Nov 2021 22:52:00 GMT

How did you exactly do it ?

You defined the public ip of the gateway as a host object, then included the host object inside a network group object and then excluded it in the excluded section of a network group with exclusions object ?

Re: Encryption Domain with Exclusion Group

Thomas_Eichelbu — Fri, 30 Jun 2023 08:19:32 GMT

Hello Dany,

the most important thing when working with Encryption Domains and Exclusions is this SK sk39679

you have to switch to "one tunnel per gateway pair" as this SK sk39679 states

best regards