Remote Access VPN for multiple Firewalls managed by same mgmt server - unable to connect

[Blason_R]

Hi Team,

Can someone please help me with my scenario?

1. I have two firewalls one in US and other is in India.
2. Both the firewalls are being managed by same mgmt server which is in India.
3. US firewall is managed with Public IP address
4. Remote access VPNs are configured on both the firewalls having office mode pools for india is 172.16.10.0/24 and US is 172.16.8.0/24
5. There is a separate VPN device in place which has a tunnel configured with say location M, eventually both the locations need to reach 10.10.10.0/24
6. Now issue is even users working from home dial in US FW and India FW and they wanted to connect to servers from 10.10.10.0/24.
7. I did add 10.10.10.0/24 in encryption domain so that users when they login can access the servers.
8. However users when they connect to India firewall they are able to access the network without issue.

But if the same user connect to US firewalls, they get a IP address from 172.16.8.0 office mode pool but unable to ping. When I do tracert to 10.10.10.10 it still shows India firewall as first hop and it does not route it through US firewall.

I have enclosed my scenario, can someone please help me on this?

[Blason_R]

Is this achievable? I mean same destination can be connected from two different firewalls as a part of encryption domain?

[AkosBakos]

Hi @Blason_R 

A hope I understood the situation. My first tip would be the Encrition domains.

Did you added the 10.10.10.0/24 to both remote access ENC_DOM (UK and India)?  

Does SmartLog shows someting when the ping unsuccessful on US site?
Did you double check the Ruleset? 
Are there any used based rule?

Akos

[Blason_R]

Yes it is added for sure and rules are added

[AkosBakos]

And there is no user based rules? I mean that somethin is limited in the Access Role object.

And Where is the 10.10.10.10 server located?

[Blason_R]

Rules are there for Remote Access vpn users. 10.10.10.10 are at remote location where site-site tunels are created from US and india location but not from checkpoint firewall. I have two routers at each locations and route is added on checkpoint i.e. 10.10.10.0/24 NH 192.168.10.2 for US Location and 192.168.20.2 for India lcoation. So that when user dials in they will be routed to router and to 10.10.10.0 network

[AkosBakos]

Interesting. Have you done a TCPdump on the US FW? Maybe you will see someting unusal.

Now I'm out of ideas.

[JozkoMrkvicka]

You have overlapping VPN encryption domain for US and India firewalls. If you want to have partially, or fully overlapping VPN encryption domain, you should use MEP feature.

[Blason_R]

Wondering MEP canbe configured for Remote access VPN?