topic Re: MEP, Remote Access and S2S in SASE and Remote Access

MEP, Remote Access and S2S

sajin — Fri, 08 May 2020 15:22:17 GMT

We had tested VPN Routing from Remote Access to S2S VPN. IN HO we do have four Firewalls for Remote Access VPN and all the four are in MEP. All the firewall is managed by single Management.

When tested, MEP is not allowing the Remote Access VPN to go to S2S because of overlapping. We just removed S2S Peer gateway from Remote Access community and everything is working fine as normal. But the problem here is there are users who will be connecting to the Peer gateway directly through Remote Access.

We need MEP and Remote Access VPN for the Peer gateway simutaneously.

Is there any road map for Multiple remote access community.

Re: MEP, Remote Access and S2S

PhoneBoy — Sun, 10 May 2020 21:26:47 GMT

Not clear how multiple Remote Access encryption domains would solve the issue you're describing.
In any case, Secondary Connect will permit the client to directly connect to the gateway where resources will be accessed from.
That's probably what you want to do here.
Refer to: http://downloads.checkpoint.com/dc/download.htm?ID=60345

Re: MEP, Remote Access and S2S

sajin — Mon, 11 May 2020 07:14:34 GMT

Hi,

Thank you for your reply.

As i mentioned in the previous loop, We had removed Peer Gateway from Remote Access Community to work Remote Access Client connect to peer gateways through HO Firewall S2S VPN because of MEP overlapping. Multiple HO Firewalls are in MEP. Now the peer gateway is not in Remote access Community. User needs to access Remote Access direct to peer gateways encryption domain.

Re: MEP, Remote Access and S2S

PhoneBoy — Mon, 11 May 2020 23:46:21 GMT

A diagram with exactly how you want the traffic to flow in this case would be helpful along with an explanation of the encryption domains in question.

Note that MEP should work if one site has an encryption domain that is a "proper subset" of the other (i.e. Site A's encryption domain is completely contained in Site B's encryption domain with no unique elements not included in Site B's encryption domain).

Re: MEP, Remote Access and S2S

sajin — Tue, 12 May 2020 07:12:47 GMT

Hello,

The Peer gateway is not the part of MEP. I had attached the screenshot for your quick reference. Please check.