Custom Remote Access VPN domain for different gateways

[Dilian_Chernev]

Hi mates,

I have the following issue to resolve 🙂

Two gateways for company users Remote access with same VPN RA domain configured - working ok.
We need to add third gateway for External Vendors with different VPN RA domain.

All three gateway are defined in the Remote Access community, MEP is turned off.

Everything works, except that external vendors gets the same routing table as defined for company users.

Am I doing something wrong? Is there some manual way to define required routes to be installed for the third gateway.

Thanks

[G_W_Albrecht]

Easy - you can use either two RA communities or Access Roles to get a very granular access policy - see https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_RemoteAccessVPN_AdminGuide/T...

[Ruan_Kotze]

Don't think multiple Remote Access communities are supported.  It was possible to create multiple RA communities at one stage, but this was a bug.

Like you said - Identity based policies using Access Roles would be the way to go here.

[G_W_Albrecht]

Yes, i would suggest to use Access Roles. Another possible configuration uses User Groups in access rules.

[Dilian_Chernev]

Thank you for the response, but I don't have issues with rules, but with injected routes on client machines 🙂

As usual it is more complicated than it sounds 🙂

On the first two gw, VPN domain is - All internet without Zoom/Webex services. ( I saw this configuration here somewhere). So clients receive huge routing table that points to the gateway, except for Zoom/Webex.

On the third gw, we want clients to receive only routes to allowed destinations and use their internet services directly, not through the gw. But in fact, they get the same routing tab as members of first two gw.

All remote access vpn domains are defined properly for each gw.
So I was thinking if there is some OS level configuration file that could help for this.

Thanks

[RS_Daniel]

Hello,

Check this sk: Remote Access client download routes from all gateways in the Remote Access Community

I think it fits your scenario, and yes, the solution seems to be configured at OS level. HTH.

Regards

[G_W_Albrecht]

Here, no MEP is used, so sk92676 should not apply.

[RS_Daniel]

Hello,

I have mep disabled too, but line client_policies still presents mep&# part. Just tested the sk and my routing table decreased from 321 routes to 65. Did not verify that those 65 correspond exactly to the RA vpn domain of the gateway i am connecting too, but think it is worth a try.

Regard

[Dilian_Chernev]

This sk seems promising!

I will try it!

Thanks

[G_W_Albrecht]

I would not suggest such a topology for RA clients. With Access Roles, only parts of the internal networks can be made available to a subgroup of clients.