Can a Checkpoint GW have more than 1 RA VPN Profile?

[Larry_Chisholm]

Is there any way to create multiple remote access vpn profiles like with the ASA?

I have two different domains, and I'd like my users to access their own specific domain AD for login authentication

I have a RA VPN set up right now that performs ldap lookups against domain1.local but I want to add a second profile that does it's lookups against domain2.local's  AD.  Is this possible with checkpoint?

[PhoneBoy]

You can configure one gateway to consult multiple LDAP servers.

Though I guess there is a question about which LDAP server will get priority and that may not be desirable.

To ensure completely different settings, you would need to use VSX (a virtual gateway for each domain).

[Louis_Poulin]

If you use VSX (a virtual gateway for each domain) and you use the same SmartConsole to manage them, they will be all part of the "Remote Access" VPN Community, right?

In that case, will the client try to authenticate to each virtual Gateway because of the "Secondary Connect" feature?

[Norbert_Bohusch]

You can configure the account unit (AD) to query in gateway settings

[Houssameddine_1]

As I mentioned before the management server is considered one site. all the gateways in the remote access community are part of one site. For secondary connect the  client will try to establish secondary connection if it find some traffic to go to different encryption domain behind different gateway in the remote access community.

[Houssameddine_1]

Checkpoint queries all account units at the same time the first to respond checkpoint gw will use that information. The problem that you have if the same user exists in both account units and you will run to race condition. There is another option which you change the  attribute that will be used to search the users for example you can use userprinciple name (by default checkpoint uses sAMaccount Name) but the user have to use his email to login not just user name.

Thanks