Domain objects in remote access encryption domain.

[khodgson_bts]

Hello all!

Just completed an upgrade of management to R81.20 from R81.10. It manages 3 x clusters currently running on R80.40 (upgrade imminent).

One of the clusters is used for the remote access VPN, and now when pushing policy we get the following error:

"You can use updateable objects, dynamic objects and domain objects in a Remote Access VPN community only as members of a network group whose name starts with 'exclusions_'. The group whose name starts with 'exclusions_' must be a member of another network group."

There is only one domain object in use and I've tried this workaround and it still fails. The only way to get a successful policy installation is to remove the domain object from the RA encryption domain entirely.

TAC have not been much use so far.

Any ideas?

[the_rock]

Hey,

Can you send a screenshot please? I can try it in my lab and report back.

Best,

Andy

[khodgson_bts]

OK so this seems to be expected behaviour (working as intended). Domain objects are not permitted in the encryption domain for an remote access VPN except in a very specific scenario detailed here.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/C...

Clearly this has never worked, but until now it's not really been flagged up or enforced during a policy installation.

[the_rock]

This part is actuallly true, just tested it.

Andy

"You can use updateable objects, dynamic objects and domain objects in a Remote Access VPN community only as members of a network group whose name starts with 'exclusions_'. The group whose name starts with 'exclusions_' must be a member of another network group."

[khodgson_bts]

We couldn't get that to work. Is it possibly due to the gateways still being R80.40?

[the_rock]

Not sure, but it might be only possible in R81+

Andy

[khodgson_bts]

Would you mind screenshotting what you've done so I can compare it to what we have please?

[khodgson_bts · Accepted solution]

So it seems that it's only supported in gateways from R81.20.

Why it didn't give this error message in the production environment I don't know.

[the_rock]

Not sure, but it would seem so.

Best,

Andy

[the_rock]

@khodgson_bts 

Sorry to revisit this a year later, but wanted to check something with you. We actually used this method recrntly with a customer to add 2 domain objects into group that started with exclusions_ and then added that group into RA vpn domain. Worked like a charm.

Now, tested today with another client, it failed, but could have been the domain itself. Now, TAC is telling us this exclusions_ group is used to exclude things, NOT include them, which makes sense 100%, BUT, its still not clear to me, for sure.

Thoughts?

Andy

[ccsjnw]

Doesn't work in R82 either.