topic Re: Remote access vpn community in SASE and Remote Access

Remote access vpn community

rajesh_s — Wed, 03 Oct 2018 13:26:56 GMT

Hello all,

We have 2 gateways in remote access vpn community, If i connected one gateway after some time vpn client automatically trying to reconnect to other gateway, How do i stop vpn client automatically automatically connecting to different gateway.

Our setuup as mentioned below.

Checkpoint version R77.30

Remote access vpn community

Gateway1 1.1.1.1 (San Jose)

gateway2 2.2.2.2 (Teaneck)

Gateway3 3.3.3.3 (Pittsburgh)

If i connect to gateway1 i can able to access San Jose local network, Gateway2 Teaneck and Gateway3 Pittsburgh.

San Jos users can only connect to gateway1, Teaneck user can only connect Gateway2 and Pittsburgh users can only connect to gateway3,

First time San Jose user while connecting remote access vpn they will select the Gateway1 and connect will successful but after some time vpn client automatically trying to reconnect to gateway2 and ask to enter the credentials, user will enter the gateway1 credentials then authentication will fail after 3 attempts user account getting locked.

How do i stop automatically connecting to different gateways?.

Re: Remote access vpn community

PhoneBoy — Thu, 04 Oct 2018 02:33:32 GMT

Sounds like each gateway should have a different Remote Access VPN community.

Why don't they?

Re: Remote access vpn community

GrassF — Thu, 18 Feb 2021 14:22:30 GMT

Hi,

what was the solution to this issue. I'm having the same issue with R80.40.

Thank you

Re: Remote access vpn community

GregorioLujan — Mon, 05 Apr 2021 14:03:59 GMT

Hello.

Do you found any solution? I have the same behavior in R80.10.

Thank you very much.

Re: Remote access vpn community

GregorioLujan — Mon, 05 Apr 2021 14:45:24 GMT

Hello.

I think that in some versions it is not possible to create two different Remote Access VPN communities. For example, in R80.10 is not possible.

Do you know a proper way to configure independent Remote Access VPNs? I have two gateways managed by the same Smart Console. And I need to create one independent RA VPN to each gateway.

But I obtain the same behaviour. After logging in to the first gateway, the VPN client tries to log in to the other gateway.

Thank you very much.

Re: Remote access vpn community

PhoneBoy — Mon, 05 Apr 2021 15:35:41 GMT

There can only be a single RemoteAccess community per management domain.
Further, a gateway can only have one encryption domain for Site-to-Site VPN and a separate one for Remote Access.
You can use access control rules to determine who can access what.
Truly separate RemoteAccess communities requires separate gateways managed by a separate management domain.
Otherwise, you’re in RFE territory.

Re: Remote access vpn community

Vladimir — Mon, 05 Apr 2021 19:53:52 GMT

Do you have "Always Connect" option disabled for all three sites?

If not, they will inevitably attempt to reconnect and boot each other out.

Re: Remote access vpn community

GrassF — Tue, 06 Apr 2021 07:23:06 GMT

Hi,

my issue has been resolved with sk78180. The automatic mep topology should be disabled.