Definition Object "Internet"

[B_Andre]

How is the complete Definition of the Object "Internet" in SmartConsole ? 

as i already found it should include Traffic which is going through an Interface which is marked as external. 

Now my Problem: 

we have a VPN to a Customer. 

The Website of the Customer is hosted on the same IP like the Peer for VPN.

Somehow the Rule for Internet access is now not used and the Traffic gets Blocked in the Cleanup Rule.

So now my Question:

What is really included in the Object "Internet" ? 

Or am i forced to use !RFC1918 to simply include every IP except Private? 

[BikeMan]

Hi,

Trying to understand your issue. You have a S2S vpn with a remote peer (one of your customers). This customer is also hosting on the same ip used for VPN their web site. And you can't reach their web site anymore from internal network. 

So CustomerIP = IP registered in the S2S vpn = IP of their web site.

S2S VPN: working fine.

Http (or https) to CustomerIP from your internal network doesn't work.

Right?

Thanks,

[Chris_Atkinson]

Have you already handled sk108600 scenario 3?

[PhoneBoy]

"Internet" means traffic routed through the external interface that doesn't go through a VPN.
Gateway IP is always included in the encryption domain by default unless it's disabled (sk108600 option 3), which is probably why it is getting handled via a different rule.

[B_Andre]

Thanks for the fast reply. 

So if i understood correctly, i have the following options to solve this. 

1. sk108600 scenario 3 --> edit "crypt.def"

2. use of a normal Network Group like !RCF1918 which shouldn't care if its also a Peer IP or not.

Both should work if i get it right ?

[PhoneBoy]

The only way to prevent the gateway from including it's own IP in the encryption domain is editing crypt.def OR, if this is an option (believe this is only possible on R81.20):

Not sure what you mean by your second point.
However, it would help tremendously if you could show what rules are matching (what you expect versus what actually is).

[the_rock]

Phoneboy explained it perfectly.