topic How to update RA encryption domain dynamically? in SASE and Remote Access

How to update RA encryption domain dynamically?

abihsot__ — Tue, 26 Oct 2021 10:30:51 GMT

Hello,

Gateway is R80.40 and I have bunch of endpoint security VPN clients.

hub mode is NOT enabled.

For example I want that checkpoint.com would be part of encryption domain. The problem is that I cannot add domain or any other clever object into encryption domain. Only host or network objects allowed.

Do you have any ideas how it could be implemented easily? Maybe someone already got script working in action?

I was thinking of resolving domain to IPs and then feeding them to API to create objects and pushing the policy. On next client connect new topology should be downloaded.

Re: How to update RA encryption domain dynamically?

_Val_ — Tue, 26 Oct 2021 11:15:29 GMT

I think you have already answered your own question.

Now, why would you need to add a domain to the encryption domain of your VPN in the first place? Those network objects are supposed to be internal.

Re: How to update RA encryption domain dynamically?

abihsot__ — Tue, 26 Oct 2021 12:57:54 GMT

Between black (Hub mode) and white (internal network), grey color exist, where you might want to do it only for certain applications. For example where restriction is based on HQ IP. Because IP of the domain can change, ability to add domain object inside encryption domain would be extremely useful.

I hope it would be of interest for Checkpoint to implement it at some point.

Re: How to update RA encryption domain dynamically?

PhoneBoy — Tue, 26 Oct 2021 18:03:08 GMT

The closest thing we have is: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk167000&partition=Basic&product=IPSec
There is also a customer release that allows for Updatable Objects and Dynamic Objects to be used for the encryption domain.
Please check with your local Check Point office for further details.

Re: How to update RA encryption domain dynamically?

abihsot__ — Wed, 27 Oct 2021 06:42:34 GMT

Yes, I am aware of this SK and it is indeed nice workaround playing with exclusion list.

Thanks for heads-up, it was worth describing my problem here. I'll check with local office what they have.