topic Custom Remote Access VPN domain for different gateways in SASE and Remote Access

Custom Remote Access VPN domain for different gateways

Dilian_Chernev — Mon, 30 May 2022 07:59:03 GMT

Hi mates,

I have the following issue to resolve 🙂

Two gateways for company users Remote access with same VPN RA domain configured - working ok.
We need to add third gateway for External Vendors with different VPN RA domain.

All three gateway are defined in the Remote Access community, MEP is turned off.

Everything works, except that external vendors gets the same routing table as defined for company users.

Am I doing something wrong? Is there some manual way to define required routes to be installed for the third gateway.

Thanks

Re: Custom Remote Access VPN domain for different gateways

G_W_Albrecht — Mon, 30 May 2022 08:35:21 GMT

Easy - you can use either two RA communities or Access Roles to get a very granular access policy - see https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_RemoteAccessVPN_AdminGuide/Topics-VPNRG/Configuring-Policy.htm?tocpath=Configuring%20Policy%20for%20Remote%20Access%20VPN%7C_____0#Configuring_Remote_Access_Policy

Re: Custom Remote Access VPN domain for different gateways

Ruan_Kotze — Mon, 30 May 2022 09:23:54 GMT

Don't think multiple Remote Access communities are supported. It was possible to create multiple RA communities at one stage, but this was a bug.

Like you said - Identity based policies using Access Roles would be the way to go here.

Re: Custom Remote Access VPN domain for different gateways

G_W_Albrecht — Mon, 30 May 2022 10:48:25 GMT

Yes, i would suggest to use Access Roles. Another possible configuration uses User Groups in access rules.

Re: Custom Remote Access VPN domain for different gateways

Dilian_Chernev — Mon, 30 May 2022 11:10:16 GMT

Thank you for the response, but I don't have issues with rules, but with injected routes on client machines 🙂

As usual it is more complicated than it sounds 🙂

On the first two gw, VPN domain is - All internet without Zoom/Webex services. ( I saw this configuration here somewhere). So clients receive huge routing table that points to the gateway, except for Zoom/Webex.

On the third gw, we want clients to receive only routes to allowed destinations and use their internet services directly, not through the gw. But in fact, they get the same routing tab as members of first two gw.

All remote access vpn domains are defined properly for each gw.
So I was thinking if there is some OS level configuration file that could help for this.

Thanks

Re: Custom Remote Access VPN domain for different gateways

RS_Daniel — Mon, 30 May 2022 12:21:40 GMT

Hello,

Check this sk: Remote Access client download routes from all gateways in the Remote Access Community

I think it fits your scenario, and yes, the solution seems to be configured at OS level. HTH.

Regards

Re: Custom Remote Access VPN domain for different gateways

G_W_Albrecht — Mon, 30 May 2022 12:35:11 GMT

I would not suggest such a topology for RA clients. With Access Roles, only parts of the internal networks can be made available to a subgroup of clients.

Re: Custom Remote Access VPN domain for different gateways

G_W_Albrecht — Mon, 30 May 2022 12:36:16 GMT

Here, no MEP is used, so sk92676 should not apply.

Re: Custom Remote Access VPN domain for different gateways

RS_Daniel — Mon, 30 May 2022 12:57:41 GMT

Hello,

I have mep disabled too, but line client_policies still presents mep&# part. Just tested the sk and my routing table decreased from 321 routes to 65. Did not verify that those 65 correspond exactly to the RA vpn domain of the gateway i am connecting too, but think it is worth a try.

Regard

Re: Custom Remote Access VPN domain for different gateways

Dilian_Chernev — Tue, 31 May 2022 07:00:07 GMT

This sk seems promising!

I will try it!

Thanks