topic R80.40 - Question about encryption domain per VPN community in General Topics

R80.40 - Question about encryption domain per VPN community

Marcel_Gramalla — Wed, 22 Apr 2020 08:16:44 GMT

Hello everyone,

hope your doing well these days. I have a question about the new feature in R80.40 regarding the encryption domains that can be configured per community (finally 😉).

I was wondering if this requires an R80.40 Gateway or if this also works on older Gateways. We have an R80.40 Management and we can already select to override the main encryption domain but unfortunately I have no endpoint to test if this actually works. In the release notes this feature is listed in the "Acess Control" (technically Gateway I would think) and not the Gateway or Management list so I am not sure.

As I am preparing a new Branch Office I would like to use this feature. Can anybody shed some light on this topic?

Many thanks 🙂
Marcel

Re: R80.40 - Question about encryption domain per VPN community

Maarten_Sjouw — Wed, 22 Apr 2020 10:58:01 GMT

I have a R80.20SP VSX gateway, which is certainly not R80.40 on which I could set it and push policy without errors.
I am unable to test if it really works but so far it looks promising.

Re: R80.40 - Question about encryption domain per VPN community

G_W_Albrecht — Wed, 22 Apr 2020 12:04:57 GMT

I would assume it works with R80.40 GWs - from lower versions i do know only that it will not work with 1100, 1400 and 1500 SMBs:

sk165613 R80.40 Policy Installation failure to a Branch Office Appliance involving a RemoteAccess community, due to unsupported VPN Domains

Re: R80.40 - Question about encryption domain per VPN community

Michal_Gans — Mon, 22 Jun 2020 17:42:54 GMT

I just test it with gw 80.30 (mng 80.40) and it works fine.

Re: R80.40 - Question about encryption domain per VPN community

lbcadenco10 — Mon, 02 Nov 2020 20:53:26 GMT

I tested this as well with a GW running R80.10 JHF Take 154 and it worked as expected

Re: R80.40 - Question about encryption domain per VPN community

Aitor_Carazo — Fri, 11 Dec 2020 12:02:37 GMT

This works with Gaia Embedded?
I have tested with:

Management R80.40+JHF89
Cluster on R80.20+JHF161 <---> FW 1480 on R77.20.87

And the VPN stops working.

Re: R80.40 - Question about encryption domain per VPN community

PhoneBoy — Mon, 14 Dec 2020 02:42:12 GMT

As far as I know and have been told, this feature is not gateway version specific (i.e. it should work with any supported gateway version).
In other words: as long as the management is R80.40+, you should be able to leverage this feature.

Re: R80.40 - Question about encryption domain per VPN community

henryck — Mon, 14 Dec 2020 21:54:03 GMT

Similar to @G_W_Albrecht I have experienced issues with pushing policy on SMB gateways using these type of encryption domains

Re: R80.40 - Question about encryption domain per VPN community

PhoneBoy — Mon, 14 Dec 2020 21:59:53 GMT

That SK discusses renaming the RemoteAccess community, which is definitely not supported.
That's different than having a different VPN community per domain, or are you seeing similar errors when you push to an SMB gateway?