https://community.checkpoint.com/t5/General-Topics/R81-20-JHF65-Firewall-Initiated-Traffic-Now-Considered-In-VPN/m-p/218875#M36472 <P>We have an internal site-to-site VPN that we've been running for years now where our firewalls send traffic through another firewall just fine. However, after the JHF, the remote firewall is now stating this traffic should be encrypted when the firewall is sending from an IP not in the VPN Domain. See diagram below:</P> <P>[VPNDomainNetA] --- [FWA]TX --- [LANA] --- [PrivateWAN] --- [LANB] --- [FWB] --- [VPNDomainNetB] --- RX[ServerB]</P> <P>So FWA is sending (TX) from its LANA interface to ServerB (RX).</P> <P>Why is FWB now considering this something that should be encrypted post hotfix? Obviously we can't add FWA LANA's IP to the VPN Domain as that would break all kinds of other stuff. Having to follow sk86582 (as TAC suggested) seems a bit ridiculous. Firewall interfaces not in the VPN Domain networks shouldn't be considered in the VPN Domain network.</P> Wed, 26 Jun 2024 20:30:01 GMT B_P 2024-06-26T20:30:01Z https://community.checkpoint.com/t5/General-Topics/R81-20-JHF65-Firewall-Initiated-Traffic-Now-Considered-In-VPN/m-p/218875#M36472 <P>We have an internal site-to-site VPN that we've been running for years now where our firewalls send traffic through another firewall just fine. However, after the JHF, the remote firewall is now stating this traffic should be encrypted when the firewall is sending from an IP not in the VPN Domain. See diagram below:</P> <P>[VPNDomainNetA] --- [FWA]TX --- [LANA] --- [PrivateWAN] --- [LANB] --- [FWB] --- [VPNDomainNetB] --- RX[ServerB]</P> <P>So FWA is sending (TX) from its LANA interface to ServerB (RX).</P> <P>Why is FWB now considering this something that should be encrypted post hotfix? Obviously we can't add FWA LANA's IP to the VPN Domain as that would break all kinds of other stuff. Having to follow sk86582 (as TAC suggested) seems a bit ridiculous. Firewall interfaces not in the VPN Domain networks shouldn't be considered in the VPN Domain network.</P> Wed, 26 Jun 2024 20:30:01 GMT https://community.checkpoint.com/t5/General-Topics/R81-20-JHF65-Firewall-Initiated-Traffic-Now-Considered-In-VPN/m-p/218875#M36472 B_P 2024-06-26T20:30:01Z https://community.checkpoint.com/t5/General-Topics/R81-20-JHF65-Firewall-Initiated-Traffic-Now-Considered-In-VPN/m-p/219281#M36538 <P>Are both gateways managed by the same manager?</P> <P>The gateway with all of its IP addresses are automatically included in the encryption domain.<BR />This has been the case for as long as I can remember unless you modify the relevant .def files.<BR /><BR /></P> Mon, 01 Jul 2024 15:20:21 GMT https://community.checkpoint.com/t5/General-Topics/R81-20-JHF65-Firewall-Initiated-Traffic-Now-Considered-In-VPN/m-p/219281#M36538 PhoneBoy 2024-07-01T15:20:21Z https://community.checkpoint.com/t5/General-Topics/R81-20-JHF65-Firewall-Initiated-Traffic-Now-Considered-In-VPN/m-p/219305#M36541 <P>That's really bad practice. The crypt.def file is dumb practice to begin with because it gets overwritten on upgrades. It's even more dumb that a firewall considers IPs that don't belong to a network as belonging to a network.</P> <P>When it comes to security, quirks like this are dangerous and frankly have no place in an enterprise security system.</P> Mon, 01 Jul 2024 17:29:12 GMT https://community.checkpoint.com/t5/General-Topics/R81-20-JHF65-Firewall-Initiated-Traffic-Now-Considered-In-VPN/m-p/219305#M36541 B_P 2024-07-01T17:29:12Z https://community.checkpoint.com/t5/General-Topics/R81-20-JHF65-Firewall-Initiated-Traffic-Now-Considered-In-VPN/m-p/219309#M36543 <P>So you want to exclude the external IP of the FW from the encryption domain if I get it right?</P> <P>There is an option in R81.20 in the gateway/cluster properties under VPN Domain to do so without editing .def files.</P> Mon, 01 Jul 2024 18:55:52 GMT https://community.checkpoint.com/t5/General-Topics/R81-20-JHF65-Firewall-Initiated-Traffic-Now-Considered-In-VPN/m-p/219309#M36543 Alex- 2024-07-01T18:55:52Z