topic Re: Appliance 1900 doesn't recognise local encryption domain in SASE and Remote Access

Appliance 1900 doesn't recognise local encryption domain

Exonix — Fri, 28 Mar 2025 00:23:06 GMT

Hello,

we have centally managed Appliance 1900 with RAS VPN configured. The SMB has been added to a cluster consisting of a single node.

I can connect, but in the routing table I see all my networks and interfaces instead of the manually specified encryption domain. Why doesn't the security gateway see the local domain?

Thank you!

Re: Appliance 1900 doesn't recognise local encryption domain

the_rock — Fri, 28 Mar 2025 01:18:38 GMT

Did this ever work? Does deleting/re-creating the site do anything?

Andy

Re: Appliance 1900 doesn't recognise local encryption domain

Exonix — Fri, 28 Mar 2025 01:33:42 GMT

This is a new setup, but we have another Appliance, that is not a member of the cluster and not managed centralized - it works there.

The recreation of the site didn't help. The strange thing is, that CLI shows "enc-dom auto" 🤷🏼‍

Re: Appliance 1900 doesn't recognise local encryption domain

the_rock — Fri, 28 Mar 2025 02:10:41 GMT

I dont really work much with SMB appliances, but see in smart console, when you edit the object, is there anything like on regular gaia appliances under network -> vpn domain? If so, you can check to make sure same group is configured for remote access vpn domain.

Andy

Re: Appliance 1900 doesn't recognise local encryption domain

Exonix — Fri, 28 Mar 2025 03:06:24 GMT

VPN Domain is for SiteToSite VPN. This works. I will open a ticket...

Re: Appliance 1900 doesn't recognise local encryption domain

Exonix — Fri, 28 Mar 2025 15:55:16 GMT

I was given this article, but it didn't help and I'm not sure this is my case at all: what is the difference between "all the gateways" and "connected gateway"?

Cause

Endpoint client downloads the encryption domain of all the gateways in the Remote Access community including the gateway's topology.

Currently there is no option to configure the client to download the topology of the connected gateway only.

Re: Appliance 1900 doesn't recognise local encryption domain

the_rock — Fri, 28 Mar 2025 15:55:09 GMT

Does not sound to me like your case either.

Andy

Re: Appliance 1900 doesn't recognise local encryption domain

Exonix — Wed, 09 Apr 2025 16:00:40 GMT

I found this in the logs on my PC:

[ 3880 4280][9 Apr 11:25:31][CONFIG_MANAGER] ConfigurationManager::addIPRange(): attribute name IP_RANGE, attribute value - list of wrong addresses

[ 3880 4280][9 Apr 11:26:21][TR_CONN_MANAGER] is_secondary_connect_enabled_and_supported_on_gw: enter... [ 3880 4280][9 Apr 11:26:21][CONFIG_MANAGER] is_secondary_connect_enabled_and_supported_on_gw return value false, because it is Gateway config variable. Scope: site XXX.XXX.XXX.XXX ,gw NULL ,user USER [ 3880 4280][9 Apr 11:26:21][TR_CONN_MANAGER] is_secondary_connect_enabled_and_supported_on_gw: site XXX.XXX.XXX.XXX support 'secondary connect': 0 [ 3880 4280][9 Apr 11:26:21][CONFIG_MANAGER] ConfigurationManager::getIPRangeWithAttrName() inside. Attribute name: IP_RANGE [ 3880 4280][9 Apr 11:26:21][CONFIG_MANAGER] ConfigurationManager::getIPRangeWithAttrName() inside. Attribute name: EXCLUSION_RANGE [ 3880 4280][9 Apr 11:26:21][CONFIG_MANAGER] ConfigurationManager::getIPRangeWithAttrName() inside. Attribute name: INCLUSION_RANGE [ 3880 4280][9 Apr 11:26:21][TR_CONN_MANAGER] TrConnManager::setIpRangesOnConnData: enter... [ 3880 4280][9 Apr 11:26:21][TR_CONN_MANAGER] TrConnManager::setIpRangesOnConnData: (debug added range) ip-range-first-ip0 / yyy.yyy.yyy.0 - ip-range-last-ip0 / yyy.yyy.yyy.255 [ 3880 4280][9 Apr 11:26:21][TR_CONN_MANAGER] TrConnManager::setIpRangesOnConnData: (debug added range) ip-range-first-ip1 / www.www.www.0 - ip-range-last-ip1 / www.www.www.255 [ 3880 4280][9 Apr 11:26:21][TR_CONN_MANAGER] TrConnManager::setIpRangesOnConnData: (debug added range) ip-range-first-ip2 / fff.fff.fff.0 - ip-range-last-ip2 / fff.fff.fff.255 [ 3880 4280][9 Apr 11:26:21][TR_CONN_MANAGER] TrConnManager::setIpRangesOnConnData: (debug added range) ip-range-first-ip3 / ccc.ccc.ccc.0 - ip-range-last-ip3 / ccc.ccc.ccc.255 [ 3880 4280][9 Apr 11:26:21][TR_CONN_MANAGER] TrConnManager::setIpRangesOnConnData: (debug added range) ip-range-first-ip4 / nnn.nnn.nnn.nnn - ip-range-last-ip4 / nnn.nnn.nnn.nnn [ 3880 4280][9 Apr 11:26:21][TR_CONN_MANAGER] TrConnManager::setIpRangesOnConnData: (debug added range) ip-range-first-ip5 / 192.168.2.0 - ip-range-last-ip5 / 192.168.2.255 [ 3880 4280][9 Apr 11:26:21][TR_CONN_MANAGER] TrConnManager::setIpRangesOnConnData: (debug added range) ip-range-first-ip6 / XXX.XXX.XXX.XXX - ip-range-last-ip6 / XXX.XXX.XXX.XXX [ 3880 4280][9 Apr 11:26:21][TR_CONN_MANAGER] TrConnManager::setIpRangesOnConnData: (debug added range) ip-range-first-ip7 / ttt.ttt.ttt.ttt - ip-range-last-ip7 / ttt.ttt.ttt.ttt [ 3880 4280][9 Apr 11:26:21][TR_CONN_MANAGER] TrConnManager::setIpRangesOnConnData: about to set 'allowed-ip-ranges-num' to 8 [ 3880 4280][9 Apr 11:26:21][TR_CONN_MANAGER] TrConnManager::setExclusionRangesOnConnData: enter... [ 3880 4280][9 Apr 11:26:21][TR_CONN_MANAGER] TrConnManager::setExclusionRangesOnConnData: about to set 'exclusion-ranges-num' to 0

Any idea where to configure this?

Re: Appliance 1900 doesn't recognise local encryption domain

PhoneBoy — Wed, 09 Apr 2025 19:38:47 GMT

When you "add a site" you are not only adding the encryption domain of the gateway you are connect to (i.e. to add the site), you are adding the Remote Access encryption domain of every other gateway that is under the same management domain.
Which means the routes that will be set on your Remote Access client will cover more than just the 1900.

As noted above, this is expected behavior.

Re: Appliance 1900 doesn't recognise local encryption domain

Exonix — Wed, 09 Apr 2025 20:20:47 GMT

But I don't have any other gateways that are under the same management domain. If I add a second node to the cluster - will it solve the problem?

I have exactly opposite: the added routes are from 1900 - they belong to all enabled interfaces on the 1900. How can I add more networks to the client?

For now, It looks like the clustered RAS doesn't work out of the box (

Re: Appliance 1900 doesn't recognise local encryption domain

PhoneBoy — Wed, 09 Apr 2025 20:40:53 GMT

It is highly unusual to run a cluster with a single node.
However, I don't believe it will help to add the node to the clusters?
The version of firmware involved on the 1900 as well as the version/JHF on your management will be helpful for context.

For the "more networks" you want to add to the encryption domain, do you have routes for these networks configured on the 1900 already?

Re: Appliance 1900 doesn't recognise local encryption domain

Exonix — Wed, 09 Apr 2025 22:32:38 GMT

"More networks" - they belong to encryption domains of some S2S VPN. So, our users connect to our office and then go to resources located on a supplier site. Typical configuration.

You say it is unusual. OK, imagine we have classic two-node cluster. Then one node is crushed - is it still two-node cluster? Right now I can't add the second node, because it serves as main router. But tomorrow evening I will try it.

Version will come a bit later, but it is the last one.

Re: Appliance 1900 doesn't recognise local encryption domain

PhoneBoy — Wed, 09 Apr 2025 22:48:19 GMT

Not sure how adding the cluster member will make this work.

Are those S2S VPNs already set up and working correctly on the device?

Re: Appliance 1900 doesn't recognise local encryption domain

the_rock — Wed, 09 Apr 2025 22:50:40 GMT

Im with Phoneboy on this one...vpn domain would not have anything to do with the fact whether something is a cluster, single device or standalone.

Andy

Re: Appliance 1900 doesn't recognise local encryption domain

Exonix — Thu, 10 Apr 2025 05:38:16 GMT

Yes, the S2S work correctly

Re: Appliance 1900 doesn't recognise local encryption domain

Exonix — Thu, 10 Apr 2025 05:44:49 GMT

The fact is, that RAS works on a standalone FW - a client gets all routes from encryption domain.

Once the FW is added into the cluster - it stop working: no routes from VPN domain are added.

Anyway, I need to make this work...

Re: Appliance 1900 doesn't recognise local encryption domain

the_rock — Thu, 10 Apr 2025 10:45:42 GMT

Ok, lets take a step back here. So just for the context, can you please make sure that VPN domain used for single fw is exactly the SAME as when its a cluster? Also, if it is the same, can you have someone delete/re-create the site and test?

Andy

Re: Appliance 1900 doesn't recognise local encryption domain

Exonix — Thu, 10 Apr 2025 10:53:12 GMT

Yes, the VPN domain for RAS is the same. I didn't change it, but just added the fw to the cluster.

Yes, I have already recreated the connection (this is the site, right?) on the VPN client - didn't help.

Re: Appliance 1900 doesn't recognise local encryption domain

the_rock — Thu, 10 Apr 2025 10:58:23 GMT

I dont see any screenshots in your response, so cant tell exactly what you meant for the site. If you are allowed to do remote, happy to check it with you. Im good till 9 am est (GMT-5).

Let me know.

Andy

Re: Appliance 1900 doesn't recognise local encryption domain

Exonix — Thu, 10 Apr 2025 11:38:04 GMT

Thank you Andy, unfortunately, remote assistance is not allowed...

This is VPN Domain for the RAS 👇

And this is the Site/Connection 👇