topic Re: Can we have different encryption domain in STAR S2S VPN topology in Firewall and Security Management

Can we have different encryption domain in STAR S2S VPN topology

Kjohnt006 — Tue, 10 Dec 2024 13:20:50 GMT

Hi Team,

We have multiple tunnels on Checkpoint 15000 firewall configured in STAR topology. as attached in snap "VPN Topology".

For all the tunnel we have one encryption domain configured in Center Gateway. this group covers almost all the subnets. basically, it is wider group contains lots of subnets (many more subnets including exact encryption domain IPs).

We are facing issue on one of the tunnels and we want to replace wider group with specific subnets at our end in center gateway encryption domain.

can we do it? will it impact other tunnels?

please find the attached pics.

Re: Can we have different encryption domain in STAR S2S VPN topology

Lesley — Tue, 10 Dec 2024 13:52:18 GMT

On the vpn community itself you can configure custom local and remote encryption domain. Works the same as global encryption domain under the gateway object. Only difference is that the change will only have effect on the community itself and not on a global level

Re: Can we have different encryption domain in STAR S2S VPN topology

the_rock — Tue, 10 Dec 2024 14:37:42 GMT

There you can set whatever group/subnet you desire and if needed, just create new one and assign it, install policy and thats it.

Andy

Re: Can we have different encryption domain in STAR S2S VPN topology

Kjohnt006 — Tue, 10 Dec 2024 15:01:02 GMT

Hi Andy, thank you for the input... just a query, if I will change only for one community, wont it impact other communities?

Re: Can we have different encryption domain in STAR S2S VPN topology

the_rock — Tue, 10 Dec 2024 15:09:03 GMT

Thats right, it never impacts any other communities. Thats a beautiful thing since R80 that you can do this, as it was not possible via smart console back in R77 and before.

Andy