Domain objects in remote access encryption domain.

[khodgson_bts]

Hello all!

Just completed an upgrade of management to R81.20 from R81.10. It manages 3 x clusters currently running on R80.40 (upgrade imminent).

One of the clusters is used for the remote access VPN, and now when pushing policy we get the following error:

"You can use updateable objects, dynamic objects and domain objects in a Remote Access VPN community only as members of a network group whose name starts with 'exclusions_'. The group whose name starts with 'exclusions_' must be a member of another network group."

There is only one domain object in use and I've tried this workaround and it still fails. The only way to get a successful policy installation is to remove the domain object from the RA encryption domain entirely.

TAC have not been much use so far.

Any ideas?

[the_rock]

Hey,

Can you send a screenshot please? I can try it in my lab and report back.

Best,

Andy

[khodgson_bts]

OK so this seems to be expected behaviour (working as intended). Domain objects are not permitted in the encryption domain for an remote access VPN except in a very specific scenario detailed here.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/C...

Clearly this has never worked, but until now it's not really been flagged up or enforced during a policy installation.

[the_rock]

This part is actuallly true, just tested it.

Andy

"You can use updateable objects, dynamic objects and domain objects in a Remote Access VPN community only as members of a network group whose name starts with 'exclusions_'. The group whose name starts with 'exclusions_' must be a member of another network group."

[khodgson_bts]

We couldn't get that to work. Is it possibly due to the gateways still being R80.40?

[the_rock]

Not sure, but it might be only possible in R81+

Andy

[khodgson_bts]

Would you mind screenshotting what you've done so I can compare it to what we have please?

[khodgson_bts · Accepted solution]

So it seems that it's only supported in gateways from R81.20.

Why it didn't give this error message in the production environment I don't know.

[the_rock]

Not sure, but it would seem so.

Best,

Andy

[the_rock]

@khodgson_bts 

Sorry to revisit this a year later, but wanted to check something with you. We actually used this method recrntly with a customer to add 2 domain objects into group that started with exclusions_ and then added that group into RA vpn domain. Worked like a charm.

Now, tested today with another client, it failed, but could have been the domain itself. Now, TAC is telling us this exclusions_ group is used to exclude things, NOT include them, which makes sense 100%, BUT, its still not clear to me, for sure.

Thoughts?

Andy

[ccsjnw]

Doesn't work in R82 either.

[BAlexiev]

Works for exclusions, as stated in the documentation, both in R81.20 and R82. You need to add Updateable objects and Domain objects into a Network group named exclusions_RemoteAccessVPN, for example, keeping in mind that

For exclusion mode, the name must begin with:

exclusions_

Ref: Dynamic Split Tunneling for SaaS Using Updatable Objects.

Then the exclusions_RemoteAccessVPN group should be added to the group, which includes the network objects, which will be part of your VPN Domain - the group you specify in the RemoteAccess community (as override) or in the GW object configuration. For example, this group can be called RemoteAccessVPN_Networks. You should not use the exclusions_RemoteAccessVPN group directly as the VPN Domain group (which doesn't make much sense) and for now you can't add the Domain objects to another group, which you will include alongside the Updateable objects in your exclusions_RemoteAccessVPN group. Meaning no recursive resolving is currently possible.

Suggestions: @PhoneBoy

It would be nice if recursive resolving of Domain objects is added as a feature (to allow adding them to a group, which then will be added to the exclusions_ group). This will allow for cleaner configuration and will bi similar to the AD concept of adding Global groups to Domain Local groups.

Additionally, a much better approach would be to add not only company services to the Updateable objects, but similar to what we have there for US government, add other Government sites/domains for each country as Updateable objects. This would mean we have just one "group" added to the exclusions_ group and since Government sites are excluded from HTTPS Inspection and many times blocked from other countries, we will easily exclude them from the RA VPN tunnels.