topic Encryption domain for remote access VPN in Hyperscale Firewall (Maestro)

Encryption domain for remote access VPN

NiladriSarkar — Thu, 07 Mar 2024 13:42:38 GMT

We are on 81.10 take 95, running remoteaccess VPN.

When we add a FQDN object to the encryption domain we see the following error :: he main group must contain ip-based objects only.

Does this mean we cannot add FQDN to enc domain at all ?

Re: Encryption domain for remote access VPN

emmap — Tue, 12 Mar 2024 08:40:30 GMT

This isn't a Maestro thing, FQDNs aren't supported in any R81.10 gateway as far as I know.

In R81.20 we introduced dynamic exclusions for encryption domains using dynamic objects and domain objects, I don't know if you can use FQDNs to include IPs dynamically though, I can't find anything useful on that.

Re: Encryption domain for remote access VPN

PhoneBoy — Tue, 12 Mar 2024 14:55:48 GMT

Correct, this feature is only for excluding items from the encryption domain, not including.
I presume this should be addressed as an RFE with your local Check Point office.