topic Re: Dynamic groups in crypt.def file for "NON_VPN_TRAFFIC_RULES" in SASE and Remote Access

Dynamic groups in crypt.def file for "NON_VPN_TRAFFIC_RULES"

olgrech — Wed, 17 Feb 2021 02:39:16 GMT

sk113112 shows an example for gateways. What is the correct method for the gateway members in a cluster?

all@cluster1

IP addresses for external interfaces need to be excluded from VPN so Remote Access clients can connect. I'd prefer to add on multiple clusters, each with their unique addresses.

Thanks,

Greg

Re: Dynamic groups in crypt.def file for "NON_VPN_TRAFFIC_RULES"

PhoneBoy — Wed, 17 Feb 2021 06:16:36 GMT

You have to list the individual members, I believe, so your second example.

Re: Dynamic groups in crypt.def file for "NON_VPN_TRAFFIC_RULES"

G_W_Albrecht — Wed, 17 Feb 2021 10:15:23 GMT

The sk113112 already gives a good example for the cluster nodes of gw4 in line 3:

all@{gw4a,gw4b} vpn_exclude={192.168.4.1,192.168.4.255};

Re: Dynamic groups in crypt.def file for "NON_VPN_TRAFFIC_RULES"

olgrech — Wed, 17 Feb 2021 13:09:01 GMT

That's what I was thinking, but didn't want to assume. There's no mention of cluster. I'll give that a shot.

Thanks!

Re: Dynamic groups in crypt.def file for "NON_VPN_TRAFFIC_RULES"

G_W_Albrecht — Wed, 17 Feb 2021 14:07:38 GMT

After years of CP clustering, GW4a and GW4b naturally represent two cluster nodes to me - but it is not explained in sk113112. But e.g., in ClusterXL R80.40 Administration Guide p.48, Example ClusterXL Topology Example Diagram has in Description:

Security Gateway - Cluster Member A

Security Gateway - Cluster Member B