topic VPN Limitation: Encryption domain > supported objects per tunnel type in Firewall & Security Management

VPN Limitation: Encryption domain > supported objects per tunnel type

Danny — Thu, 03 Aug 2023 09:08:28 GMT

Check Point RnD informed us, that there is an important limitation for VPN Site-to-Site tunnels to consider:

The only tunnel sharing method that supports a mix of network object types (hosts, ranges, networks etc.) is "tunnel per Gateway pair". "tunnel per each pair of hosts" must include host objects only and "tunnel per subnet pair" must include network objects only. Anything else is considered a misconfiguration.

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

Magnus-Holmberg — Thu, 03 Aug 2023 10:32:50 GMT

That one should really be put in to a "info" box on each option here.
Always struggling with more advance vpn boxes and ends up using user.def file to make sure its how i want to to be configured.

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

the_rock — Thu, 03 Aug 2023 14:05:44 GMT

In 15 years, I never knew of that. But, in all honesty, maybe that never used to be an issue in old versions, cant recall now : - )

Thanks for sharing!

Andy

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

the_rock — Thu, 03 Aug 2023 14:06:54 GMT

I know Phoneboy mentioned in one of the posts that there are lots of new options coming for VPN settings in smart console starting R82 version, so this might be one of them, we shall see : - )

Andy

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

Magnus-Holmberg — Thu, 03 Aug 2023 14:34:23 GMT

I hope they fix so you can see standard issues in the log aswell and dont need to actually debug the traffic to figure out you sending the incorrect subnetmask or similar 🙂

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

the_rock — Thu, 03 Aug 2023 14:35:32 GMT

That would be super useful 🙂

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

DT44 — Tue, 15 Aug 2023 14:14:27 GMT

Just checking, do we know how these settings affect dynamic objects? When a dynamic object is added to a gateway it can be configured to include individual host IPs, network ranges, or both.

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

PhoneBoy — Tue, 15 Aug 2023 21:48:44 GMT

To the best of my knowledge, dynamic objects cannot be added to an encryption domain.

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

the_rock — Tue, 15 Aug 2023 22:01:08 GMT

Technically, you can, but policy will fail : - )

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

Gary_Scott — Sun, 24 Sep 2023 03:24:34 GMT

FYI, https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/Dynamic-Split-Tunneling-for-SaaS.htm?Highlight=domain

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

PhoneBoy — Mon, 25 Sep 2023 18:16:22 GMT

This I am aware of, but it must be done as described or it will not work 🙂

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

Zolocofxp — Tue, 26 Sep 2023 16:04:38 GMT

Having "One VPN tunnel per subnet pair" will let you establish tunnels between HOST<>NET and NET<>NET.

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

the_rock — Tue, 26 Sep 2023 16:05:54 GMT

Thats debatable, does not always work. I find that tunnel per gateway pair will do that 100% of the time.

Andy

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

Zolocofxp — Tue, 26 Sep 2023 16:14:55 GMT

One tunnel per gateway is ideal... It just establishes a single 0.0.0.0/0 tunnel.

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

the_rock — Tue, 26 Sep 2023 16:16:56 GMT

Thats pretty much generic for any vendor, but yes, thats indeed true.

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

SenpaiNoticed_U — Tue, 26 Sep 2023 18:37:33 GMT

For a Host object in the domain, the SA will attempt use an exact IP or in some cases I have seen it convert the IP into a /24,
While the Tunnel management is set to Subnet pair.
so if the host object is to a Peer subnet, the SA will appear like this:
| My TS: 10.140.250.1
| Peer TS: 192.168.1.0/24
or like this
| My TS: 10.140.250.0/24
| Peer TS: 192.168.1.0/24

However,
You can have it use a /32.
so if you use a network object that is a /32 instead.
you will get a SA like:
| My TS: 10.140.250.1/32
| Peer TS: 192.168.1.0/24
================

You may also be able to force it to the exact subnet you wish with user.def.FW1 edits.

But I would recommend to use Network objects for Subnet Pairing.

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

the_rock — Tue, 26 Sep 2023 18:44:13 GMT

In old days on CP and we are talking probably 15 years ago (or more), it was so annoying to have to always change guidbedit setting(s) for supernat, as it would always try to present largest possible subnet, specially with Cisco VPN tunnel.

Glad thats sorted out in R80 + : - )

Andy

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

SenpaiNoticed_U — Tue, 26 Sep 2023 18:47:42 GMT

Yes, and now with R81, Permanent Tunnels are set tp DPD for Interoperable devices be default.

Re: VPN Limitation: Encryption domain > supported objects per tunnel type

the_rock — Tue, 26 Sep 2023 18:55:33 GMT

I was very happy with that change!

Andy