Gaia traffic outside of VPN Domain is blocked due to "Clear text packet should be encrypted" ?

[B_P]

Traffic originating on "Check Point 1" (CP1) going to a network behind "Check Point 2" (CP2) is blocked by CP2 because of "Clear text packet should be encrypted." But the interface CP1 is sending the traffic from is not in the VPN Domain network and therefore should not be encrypted. Why does CP2 think CP1's traffic should be encrypted? R81.10 T95

[PhoneBoy · Accepted solution]

Scenario 3 here: https://support.checkpoint.com/results/sk/sk108600

[Daniel_Toader]

How define in a crypt.def a subnet , not just an IP.

[PhoneBoy]

Using the standard INSPECT syntax: net(<Network_IP_Address>, <Mask_Length>)

For example, for the subnet 192.0.2.0/24, you'd use: net(192.0.2.0,24)

[B_P]

That applies only when 3rd party firewalls are involved, no? Surely not when only Check Point firewalls are involved.

[Bob_Zimmerman]

It's mostly when only Check Point firewalls are involved. That functionality is how "permanent tunnels" work.

[B_P]

Regardless, Management should handle it behind the scenes. I don't understand Check Point's philosophy of "User interface says one thing and system does another."