Limiting OfficeMode to a LDAP Group with AD Computer objects inside

Teddy_Brewski — Wed, 09 Aug 2023 15:41:21 GMT

Hello,

I'm working on a new gateway that will allow VPN connectivity based on machine certificates and would like to limit OfficeMode to a LDAP group that contains AD computer objects from our Active Directory.

Defining 'Only Group in branch' and specifying the relevant group in the LDAP Group object does exactly what I need, but my question is: do I need to push the policy every time the AD group is modifed or the AD will be queried each time there is a VPN connection attempt? I tried to add a couple of computer objects in the AD group and connect and get an error 'User not in Office Mode group'. The moment I pushed the policy -- it worked.

PS: VSX R80.40 (latest take)

Thank you.

Re: Limiting OfficeMode to a LDAP Group with AD Computer objects inside

PhoneBoy — Wed, 23 Aug 2023 22:16:36 GMT

It may be that information was cached that got "cleared" with a policy install.
Or, if you waited some time, it would update.
In any case, this may require a TAC case to investigate: https://help.checkpoint.com

topic Limiting OfficeMode to a LDAP Group with AD Computer objects inside in SASE and Remote Access

Limiting OfficeMode to a LDAP Group with AD Computer objects inside

Re: Limiting OfficeMode to a LDAP Group with AD Computer objects inside