topic Re: Full Encyption Domain Overlap in Firewall and Security Management

Full Encyption Domain Overlap

Jon_Dyke — Wed, 12 May 2021 11:02:45 GMT

We are about to setup a new tunnel with another office which has a subnet that is in our encryption domain. The new office has a Fortinet cluster but they also have an 192.168.0.0/22 subnet. The diagram shows our current Checkpoint star community and we need to connect two sites to this cluster. I am interested in how would people suggest we best deal with this? I am guessing if we cannot change the subnet at one end then we will need to NAT the entire subnet at the Fortinet. I currently have the 3 checkpoint clusters setup as centre GW's in the start community so I assume it would be better to add the Fortinet as a satellite to the same community rather than create two new ones (connecting site 2 would not be a problem).

Re: Full Encyption Domain Overlap

PhoneBoy — Fri, 14 May 2021 21:55:14 GMT

Your choices are NAT or renumber one side or the other.
And you'd probably create a separate VPN community between Site1/3 and the Fortinet Cluster.

Re: Full Encyption Domain Overlap

the_rock — Fri, 14 May 2021 22:25:19 GMT

I cant recall now, but there is an sk that explains how to do this with user.def file on mgmt server if you have overlapping domains.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108600&srcFavorites=favorites#Scenario%201

By the way, I know there are some new guidbedit vpn features in R80, but I dont believe they are related to overlapping enc domains. Let me check if I can find anything for you, because I had similar scenario with customer recently.

Re: Full Encyption Domain Overlap

the_rock — Fri, 14 May 2021 22:28:18 GMT

Also, below might help as well...

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106837&partition=Basic&product=IPSec