topic Re: Domain objects in remote access vpn domain in SASE and Remote Access

Domain objects in remote access vpn domain

the_rock — Fri, 11 Apr 2025 12:36:01 GMT

Hey guys,

I really hope someone can confirm this for me, because I find it a bit confusing. Its reference to below post:

https://community.checkpoint.com/t5/General-Topics/Domain-objects-in-remote-access-encryption-domain/m-p/207148#M34366

So, my colleague and I did it the same way for a client last week and worked like a charm, we added 2 domains in new group called exclusions_ and then added that group to RA vpn domain, pushed policy, tested after reconnecting to their VPN, no issues!

Then, we followed the same for another client, but was failing, could be the site, not sure. Then, we opened TAC case and were told this is NOT supported, to add domains to vpn domain and exclusions group is to exclude things, not include them, though not sure this is officially documented anywhere, at least that I was able to find.

Here is my logic about it...to me personally, does not matter what group is called, as long as it belongs to the vpn domain, there would be no reason not to work. To exclude something, from my experience, you would simply add group with exclusions.

Or am I missing this completelly?

Thoughts? 🙂

Tx as always!

Andy

Re: Domain objects in remote access vpn domain

G_W_Albrecht — Fri, 11 Apr 2025 13:02:10 GMT

Documented here: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/Dynamic-Split-Tunneling-for-SaaS.htm

Re: Domain objects in remote access vpn domain

the_rock — Fri, 11 Apr 2025 13:08:29 GMT

I know that link, thats same one from the original post, but I dont see anywhere there stating that this is not supported.

Andy

Re: Domain objects in remote access vpn domain

the_rock — Fri, 11 Apr 2025 22:08:12 GMT

Quick update. TAC gave us below sk, but Im not sure if it is applicable in this case, but maybe someone can confirm. Anyway, we will test this ourselves in customer's environment to see if we can get it working.

Andy

https://support.checkpoint.com/results/sk/sk142832

Re: Domain objects in remote access vpn domain

the_rock — Sun, 13 Apr 2025 14:07:50 GMT

Latest update:

Confirmed with R&D that adding domains is indeed supported and what I attached proves it as well.

Andy

Re: Domain objects in remote access vpn domain

the_rock — Mon, 14 Apr 2025 18:17:56 GMT

Issue fixed. It was the method using group that starts with exclusions_ that needed to be added to RA vpn domain, but appears was website issue.

Andy