topic Re: Own gateway interfaces' address excluded from Remote Access VPN in SASE and Remote Access

Own gateway interfaces' address excluded from Remote Access VPN

hugothebas — Wed, 21 May 2025 16:23:40 GMT

Hello, I need to understand why the gateway is excluding all of it's interfaces from the remote access vpn.

For example:

the above interface is one of them, but the issue happens with all interfaces.

The remote acces encryption domain includes that subnet:

After connecting to VPN client, on the endpoint side I see that the /24 subnet is divided into smaller subnets and the gateway's interface IP is excluded from the routes:

I've already checked if is there any overlap os other VPNs and there is none

Does anyone know what could be causing this issue?

Thanks!

Re: Own gateway interfaces' address excluded from Remote Access VPN

Lesley — Wed, 21 May 2025 16:44:42 GMT

This is for tunnel_test. You can also disable this and exclude firewall IP from encryption domain.

https://support.checkpoint.com/results/sk/sk180716

Re: Own gateway interfaces' address excluded from Remote Access VPN

hugothebas — Wed, 21 May 2025 16:57:58 GMT

Thank you, but that doesn't solve my issue. I have already tried doing it, the result is the same.

Re: Own gateway interfaces' address excluded from Remote Access VPN

PhoneBoy — Wed, 21 May 2025 19:24:17 GMT

Is this causing an actual issue above and beyond the cosmetics of those routes existing in the routing table?
Pretty sure this is expected behavior as we want to make sure any access to the gateway IP addresses does NOT go through the VPN and those routes are explicitly for that purpose.

Re: Own gateway interfaces' address excluded from Remote Access VPN

Lesley — Wed, 21 May 2025 20:14:26 GMT

ah VPN clients. I see now normal enc domain can you double check remote access enc domain?

Re: Own gateway interfaces' address excluded from Remote Access VPN

hugothebas — Wed, 21 May 2025 20:16:46 GMT

Hello @PhoneBoy!

The main issue is that it is impossible to connect to the gateway vis SSH, HTTPS, etc.

As of now, to reach the gateway, I need to access another host (the SMS, for example) and then jump to the gateway.

About your comment: "Pretty sure this is expected behavior as we want to make sure any access to the gateway IP addresses does NOT go through the VPN and those routes are explicitly for that purpose." - This behavior is only on this gateway, I connect to other customers from VPN client and have no problem accessing the gateway's internal interfaces through VPN.

Thank you!

Re: Own gateway interfaces' address excluded from Remote Access VPN

hugothebas — Wed, 21 May 2025 22:34:39 GMT

Sorry about that, I should have sente the vpn domain of remote access community before.

There it is:

Thanks.

Re: Own gateway interfaces' address excluded from Remote Access VPN

the_rock — Thu, 22 May 2025 00:34:30 GMT

Make sure that subnet is not inadvertantly natted.

Andy

Re: Own gateway interfaces' address excluded from Remote Access VPN

Lesley — Thu, 22 May 2025 08:26:18 GMT

Check, are the VPN clients up to date? What version?

Second tip:

Maybe work something out with crypt.def (exclude firewall ip from tunnel)

https://community.checkpoint.com/t5/General-Topics/VPN-traffic-exclusion-with-crypt-def/m-p/167592

Re: Own gateway interfaces' address excluded from Remote Access VPN

hugothebas — Thu, 22 May 2025 17:37:57 GMT

Client is the latest version "Endpoint Security E88.70".

Exclude gateway from tunnel with crypt.def file would make it send the routes (encryption domain) to the client? I can try, but I don't think so.

Thanks

Re: Own gateway interfaces' address excluded from Remote Access VPN

hugothebas — Thu, 22 May 2025 17:39:14 GMT

Hello, @the_rock!

I have certified there is no nat involved in this communication.

Thanks.

Re: Own gateway interfaces' address excluded from Remote Access VPN

the_rock — Thu, 22 May 2025 17:47:00 GMT

Okay. Just to verify, is this the ONLY subnet with the issue once connected? If so, please check to see if topology on that interface is 100% right.

Andy

Re: Own gateway interfaces' address excluded from Remote Access VPN

PhoneBoy — Thu, 22 May 2025 18:35:20 GMT

Well, yes, that is an issue as this should be possible.
Wondering if there's a setting in one of the trac configuration files that might be impacting this?

Re: Own gateway interfaces' address excluded from Remote Access VPN

CaseyB — Thu, 22 May 2025 18:40:54 GMT

I see you are using a granular encryption domain. What version are you running?

It could be this: sk170857

Re: Own gateway interfaces' address excluded from Remote Access VPN

JozkoMrkvicka — Thu, 22 May 2025 21:33:48 GMT

I handled the same issue in the past. Dont remember what kind of setting was changed, but something says me it might be related to supernetting within GuiDBedit setting. Will check it further and let you know.

Re: Own gateway interfaces' address excluded from Remote Access VPN

the_rock — Thu, 22 May 2025 21:44:42 GMT

These are the ones I know of in guidbedit that should be set to false.

Andy

ike_enable_supernet

ike_p2_enable_supernet_from_R80.20

ike_use_largest_possible_subnets

Re: Own gateway interfaces' address excluded from Remote Access VPN

hugothebas — Thu, 22 May 2025 23:06:30 GMT

Hello, @CaseyB.

I'm on R82 Take 12, but this has been happening since R81.10, I was avoiding dealing with it, but I can't postpone anymore, need to solve it.

Thanks.

Re: Own gateway interfaces' address excluded from Remote Access VPN

hugothebas — Thu, 22 May 2025 23:08:09 GMT

No, the gateway has 4 interfaces on different subnets, the behavior is the same for all of them.

Thanks!

Re: Own gateway interfaces' address excluded from Remote Access VPN

hugothebas — Thu, 22 May 2025 23:10:53 GMT

Well, I'm m gonna check trac config file, but I don't see how it could cause this issue.

I'll let you know.

Re: Own gateway interfaces' address excluded from Remote Access VPN

hugothebas — Thu, 22 May 2025 23:11:51 GMT

I'm gonna try it tomorrow and post here the result.

Thanks!