topic 2 Remote Access communities within the same SMS in SASE and Remote Access

2 Remote Access communities within the same SMS

marcinw — Mon, 10 Jan 2022 13:03:08 GMT

Is it possible having 2 remote access communities for 2 different firewalls (that are already in the same Meshed VPN community as well) with the same list of users on the same SMS ? Even if possible , should I expect any possible issues ?

thanks

Re: 2 Remote Access communities within the same SMS

the_rock — Mon, 10 Jan 2022 14:17:58 GMT

I do not believe that was ever possible...MAYBE at some point in R80.20 (I THINK), but it got removed right away. I am 99.99% sure you can have only 1 RA community.

Re: 2 Remote Access communities within the same SMS

Chris_Atkinson — Mon, 10 Jan 2022 14:30:03 GMT

It was a bug in the GUI at the time, see the previous discussion about this here:

https://community.checkpoint.com/t5/Remote-Access-VPN/Multiple-Remote-Access-Communities-GW-Version/td-p/10807

Re: 2 Remote Access communities within the same SMS

the_rock — Mon, 10 Jan 2022 14:31:59 GMT

Yes, thats the one I was looking for : - )

Re: 2 Remote Access communities within the same SMS

marcinw — Mon, 10 Jan 2022 14:32:49 GMT

ok, thank you , now if I add 2nd gateway to the same Remote Access community and they are both in the same VPN community already ? will there be any issues ?

Re: 2 Remote Access communities within the same SMS

the_rock — Mon, 10 Jan 2022 14:34:42 GMT

I dont think it would be an issue, I see people doing it all the time...are you attempting to do MEP?

Re: 2 Remote Access communities within the same SMS

marcinw — Mon, 10 Jan 2022 14:53:57 GMT

no MEP, just second location with RA for the same group of users

Re: 2 Remote Access communities within the same SMS

the_rock — Mon, 10 Jan 2022 15:04:47 GMT

I seen lots of customers use multiple gateways in RA community.

Re: 2 Remote Access communities within the same SMS

RS_Daniel — Mon, 10 Jan 2022 19:34:37 GMT

Hello,

You need to put more details about what your requierements to get an accurate answer. I unserstand you want to manage these two gateways completely independent. In this case you need to disable secondary connect and mep on both gateways, in this way you will be able to have as many gateways as you want on the community and will be able to configure encryption domains independently.

Solved: Disabling MEP - Check Point CheckMates

Remote Access Clients for Windows 32/64-bit E80.72 and Higher Administration Guide (checkpoint.com)

On remote access clients guide look for secondary connect configuration section, and change client decide and default options to False.

Regards