topic Re: Remote Access VPN - Office mode in SASE and Remote Access

Remote Access VPN - Office mode

Christian_Koehl — Wed, 23 Mar 2022 08:57:45 GMT

Dear CheckMates,

I am a little bit confused.

In CP_R81.10_RemoteAccessVPN_AdminGuide.pdf it is discribed on page 75 in the section "IP Pool versus DHCP" to use different subnets for office mode IP ranges, when using a cluster.

Is this correct?

Do I need different office mode IP subnets for each cluster member?

Best regards,

Christian

Re: Remote Access VPN - Office mode

Chris_Atkinson — Wed, 23 Mar 2022 10:17:01 GMT

The pool should be configured for each cluster member:

Re: Remote Access VPN - Office mode

Christian_Koehl — Wed, 23 Mar 2022 10:19:47 GMT

Dear Chris,

Many thanks for your quick answer. Could you please clarify, must it be the same pool an both members or must it be different pools.

Best regards,

Christian

Re: Remote Access VPN - Office mode

Ruan_Kotze — Wed, 23 Mar 2022 11:02:07 GMT

Hmm, I've often used the same IP pool for both cluster members (typically ClusterXL HA) without issue. Maybe I should pay closer attention to the documentation😁

You don't state whether you are worried about cluster members attempting to hand out the same IP to different clients, but I'm assuming that is a concern? Client VPN connections are synchronised between cluster members so that to me implies Office Mode leases are also synchronised (will test this in my lab to be sure).

Re: Remote Access VPN - Office mode

Christian_Koehl — Wed, 23 Mar 2022 11:29:10 GMT

I also used the same subnet for office mode on both members in the past - without any problems 😀 - but I was wondering about the sentense in thr RemoteAccess Guide...

Re: Remote Access VPN - Office mode

Chris_Atkinson — Wed, 23 Mar 2022 12:49:53 GMT

There's been some similar discussion in the past: https://community.checkpoint.com/t5/Remote-Access-VPN/office-mode-network-clusterXL-HA-SSLVPN-network-extender/td-p/8120

Will request that we clarify the documentation some and report back here.

Re: Remote Access VPN - Office mode

the_rock — Wed, 23 Mar 2022 12:59:51 GMT

Yes, you should use the same. Think about it this way...say your master member c**** out and you can only use the other one. When users try to connect, they would not get proper IP address, which could cause connectivity issues.

Makes sense?