topic Re: Using same enc domain for remote access on more than one firewall in SASE and Remote Access

Using same enc domain for remote access on more than one firewall

the_rock — Sun, 14 Sep 2025 12:12:30 GMT

Hey guys,

Just for my own sanity, though we already confirmed with the customer doing this caused the issue, but they were wondering if doing so, one can make it work? So essentially have SAME remote access enc domain for 2 clusters, one for on prem and one Azure?

I cant really see how that would work, but just wondering if its even possible? if not, could they use same random subnets from large group already used for onprem to test Azure side or in order to use same one, it would need to be done during cutover window?

Tx as always!

Andy

Re: Using same enc domain for remote access on more than one firewall

the_rock — Sun, 14 Sep 2025 18:52:01 GMT

For what is worth, I even had it configured with 2 subnets from current RA group used on prem, but even that caused an issue, so now Im really wondering how this can be tested before the actual cutover.

Andy

Re: Using same enc domain for remote access on more than one firewall

Wolfgang — Sun, 14 Sep 2025 19:20:15 GMT

Hi @the_rock using the same encryption domain on multiple gateways for remote access is possible. Normally this is called and done MEP (MultipleEntryPoint). You have to have an eye for the return packets if used MEP.

I don‘t know if this help for your needs, maybe you have to describe this.

Re: Using same enc domain for remote access on more than one firewall

the_rock — Sun, 14 Sep 2025 20:09:09 GMT

Hey @Wolfgang

Thanks for that. I see what you mean, though now we have to pause on this, since we dont want to cause customer more issues, as they heavily rely on remote access. I did end up opening TAC case about it, so lets see what they say 🙂

Andy

Re: Using same enc domain for remote access on more than one firewall

the_rock — Sun, 14 Sep 2025 21:43:26 GMT

@Wolfgang

I assume this is the link you meant?

Andy

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_RemoteAccessVPN_AdminGuide/Topics-VPNRG/MEP.htm#:~:text=same%20internal%20network.-,The%20Check%20Point%20Solution%20for%20Multiple%20Entry%20Points,at%20the%20same%20geographical%20site.

Re: Using same enc domain for remote access on more than one firewall

Wolfgang — Mon, 15 Sep 2025 06:08:24 GMT

@the_rock yes, that's it. We have customers using this as active/backup and others using Loadbalancing to distribute the remote users between gateways. Works like a charm. With different IP-pools for office-mode on every gateway you are fine with the back routing to the endpoints. I always use some SAM rules (blocking HTTPS to the gateway) to test the failover to another gateway. With these SAM rule you can add and remove block rules quickly and you can skip the internal rules, because SAM rules are working before.

Re: Using same enc domain for remote access on more than one firewall

the_rock — Mon, 15 Sep 2025 10:15:55 GMT

Thanks @Wolfgang