DAIP Gateway with Remote Access VPN

[Jochen142306]

Is it possible to use a Checkpoint Gateway (OpenServer R82.10) connected to a VDSL line (dynamic IP via DHCP) as a DAIP gateway if I want to use Remote Access VPN for clients?
This is specifically for Remote Access VPN and not Site-to-Site. I’ve read conflicting information on this, which is why I’m asking whether this generally works at all and is supported. I have a DynDNS service set up.

I’ve already tested it a bit, and my current issues are:
- The DAIP gateway cannot be added to the Remote Access community (the DAIP gateway does not support Enhanced Link Mode)
- OfficeMode is not available when DAIP is active

[Tchangoloro]

Are you using Check Point Mobile / Endpoint Security VPN or the SSL VPN (Mobile Access Portal)

[Jochen142306]

Generally speaking, I don't really care whether it's remote access or SSL VPN. For now, I'd try using the remote access VPN (VPN endpoint).

[PhoneBoy]

In addition to the above, the client stores the gateway's IP address on first connect.
To make this always resolve via DNS, you need to implement: https://support.checkpoint.com/results/sk/sk103440 

Also Enhanced Link Selection does not work with Remote Access (DAIP or otherwise).

[Jochen142306]

I don't really see this as a problem right now. Since I use a DynDNS service (separate from Checkpoint), the dynamic IP is always linked to the DNS name and is therefore always accessible.

[emmap]

It's a problem for the endpoint client though, as by default the endpoint client stores the IP address of the site when it was created, then every subsequent time it connects to the IP address, not the DNS name. I believe this is part of why remote access isn't supported to be configured on a DAIP gateway. 

You might have more success looking into a SASE deployment.

[Jochen142306]

Oh, okay. Then I'll try configuring the solution suggested above.