Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

Encryption Domain with Exclusion Group

Is it possible to use an exclusion group as part of a VPN encryption domain? Or do I have to list out all the network objects that I want and not include the ones I don't want?

 

Thanks!

0 Kudos
7 Replies
Highlighted

I did for one customer whose internal subnet had another devices reachable without VPN (Switches and Routers). On my case, excluding only the hosts (ex. Remote Domain Net 192.168.1.0/24, excluding 192.168.1.2 and 192.168.1.3) It worked without issues.

0 Kudos
Highlighted

And you used an exclusion group? Object Explorer -> Network Objects -> Groups -> Group with Exclusions ?

0 Kudos
Highlighted

Yes. I configured the exclusion group as encryption domain.

Even worked excluding the external IP of remote gateway, so this way, was not included on encryption domain automatically.

0 Kudos
Highlighted
Gold

Evan,

as @KennyManrique  mentioned, it is no problem to use a group with exclusions as encryption domain.

I think 80% of our customers are doing this.

Wolfgang

0 Kudos
Highlighted

We did use it also, but found some weird behavior with it, it stopped working based on Network to Network and started working with host based tunnels instead.
Must say this was with R77.30 gateways.
Regards, Maarten
0 Kudos
Highlighted

Yes, depending on the size of the excluded hosts/networks it may cause a change in behavior for the size of the subnets proposed in IKE Phase 2, particularly when hosts (/32) are excluded.  When exclusions are used, the VPN domain is recalculated into multiple networks/subnets to exclude the desired addresses.  You can use tools like Danny Jung's VPN Domain One-liner to see this in action:

https://community.checkpoint.com/t5/Enterprise-Appliances-and-Gaia/One-liner-to-show-VPN-topology-on...

 

R80.40 addendum for book "Max Power 2020" now available
for free download at http://www.maxpowerfirewalls.com
0 Kudos
Highlighted
Pearl

Groups with exclusions have many limitations one should be aware of. (sk97246, sk101506, sk107543, sk107417, ..)

I've also mentioned this in my article about Properly defining the Internet within a security policy.

0 Kudos