R81.20 JHF65 | Firewall Initiated Traffic Now Considered In VPN Domain

[B_P]

We have an internal site-to-site VPN that we've been running for years now where our firewalls send traffic through another firewall just fine. However, after the JHF, the remote firewall is now stating this traffic should be encrypted when the firewall is sending from an IP not in the VPN Domain. See diagram below:

[VPNDomainNetA] --- [FWA]TX --- [LANA] --- [PrivateWAN] --- [LANB] --- [FWB] --- [VPNDomainNetB] --- RX[ServerB]

So FWA is sending (TX) from its LANA interface to ServerB (RX).

Why is FWB now considering this something that should be encrypted post hotfix? Obviously we can't add FWA LANA's IP to the VPN Domain as that would break all kinds of other stuff. Having to follow sk86582 (as TAC suggested) seems a bit ridiculous. Firewall interfaces not in the VPN Domain networks shouldn't be considered in the VPN Domain network.

[PhoneBoy]

Are both gateways managed by the same manager?

The gateway with all of its IP addresses are automatically included in the encryption domain.
This has been the case for as long as I can remember unless you modify the relevant .def files.

[B_P]

That's really bad practice. The crypt.def file is dumb practice to begin with because it gets overwritten on upgrades. It's even more dumb that a firewall considers IPs that don't belong to a network as belonging to a network.

When it comes to security, quirks like this are dangerous and frankly have no place in an enterprise security system.

[Alex-]

So you want to exclude the external IP of the FW from the encryption domain if I get it right?

There is an option in R81.20 in the gateway/cluster properties under VPN Domain to do so without editing .def files.