Encryption Domain with Exclusion Group

[Evan_Fisher]

Is it possible to use an exclusion group as part of a VPN encryption domain? Or do I have to list out all the network objects that I want and not include the ones I don't want?

Thanks!

[KennyManrique]

I did for one customer whose internal subnet had another devices reachable without VPN (Switches and Routers). On my case, excluding only the hosts (ex. Remote Domain Net 192.168.1.0/24, excluding 192.168.1.2 and 192.168.1.3) It worked without issues.

[Evan_Fisher]

And you used an exclusion group? Object Explorer -> Network Objects -> Groups -> Group with Exclusions ?

[KennyManrique]

Yes. I configured the exclusion group as encryption domain.

Even worked excluding the external IP of remote gateway, so this way, was not included on encryption domain automatically.

[Nikolaos_Liakop]

How did you exactly do it ?

You defined the public ip of the gateway as a host object, then included the host object inside a network group object and then excluded it in the excluded section of a network group with exclusions object ? 

[Wolfgang]

Evan,

as @KennyManrique  mentioned, it is no problem to use a group with exclusions as encryption domain.

I think 80% of our customers are doing this.

Wolfgang

[Maarten_Sjouw]

We did use it also, but found some weird behavior with it, it stopped working based on Network to Network and started working with host based tunnels instead.
Must say this was with R77.30 gateways.

[Timothy_Hall]

Yes, depending on the size of the excluded hosts/networks it may cause a change in behavior for the size of the subnets proposed in IKE Phase 2, particularly when hosts (/32) are excluded.  When exclusions are used, the VPN domain is recalculated into multiple networks/subnets to exclude the desired addresses.  You can use tools like Danny Jung's VPN Domain One-liner to see this in action:

https://community.checkpoint.com/t5/Enterprise-Appliances-and-Gaia/One-liner-to-show-VPN-topology-on...

[Danny]

Groups with exclusions have many limitations one should be aware of. (sk97246, sk101506, sk107543, sk107417, ..)

I've also mentioned this in my article about Properly defining the Internet within a security policy.

[Thomas_Eichelbu]

Hello Dany, 

the most important thing when working with Encryption Domains and Exclusions is this SK sk39679

you have to switch to "one tunnel per gateway pair" as this SK sk39679 states

best regards