topic Re: Multiple Remote Access Configuration in SASE and Remote Access

Multiple Remote Access Configuration

sercang — Wed, 28 Dec 2022 11:25:59 GMT

Hello

I need to two different type of VPN connection profiles for two different groups of users. Users in group1 must be enforced to use corporate VPN (and the all traffic must be routed via corporate GW) when they use their computers outside the internal network. Users in group2 should be able to connect internet directly and they should be able to connect corporate resources via VPN.

I searched for multiple Remote Access profile configuration but the only thing I found is that once it was available R80.10 and it was considered as bug.

--> https://community.checkpoint.com/t5/Remote-Access-VPN/Multiple-Remote-Access-Communities-GW-Version/m-p/10807#M187

Is there anyway to fulfill this requirement?

Thanks in advance

Re: Multiple Remote Access Configuration

_Val_ — Wed, 28 Dec 2022 11:31:22 GMT

You can only have a single Remote Access VPN community in the same management domain.

Re: Multiple Remote Access Configuration

the_rock — Wed, 28 Dec 2022 12:47:46 GMT

Thats correct, @_Val_ is accurate in saying that ONLY one RA community is supported.

Re: Multiple Remote Access Configuration

PhoneBoy — Wed, 28 Dec 2022 15:26:22 GMT

For this particular use case, it’s not the inability to specify multiple remote access communities that will cause an issue, it’s the fact that Route All Traffic or Hub Mode is a global setting with effectively three possible options:

Hub Mode not allowed
Hub Mode allowed, but the end user can choose
Hub Mode forced

Forcing Hub Mode only for specific groups of users is not currently possible.

Re: Multiple Remote Access Configuration

sercang — Thu, 29 Dec 2022 05:42:09 GMT

Many thanks @_Val_, @the_rock and @PhoneBoy.

For my case, the information below (by @PhoneBoy) is more applicable and explanatory:

"it’s the fact that Route All Traffic or Hub Mode is a global setting with effectively three possible options:

Hub Mode not allowed
Hub Mode allowed, but the end user can choose
Hub Mode forced"