- Products
- Learn
- Local User Groups
- Partners
- More
Check Point Jump-Start Online Training
Now Available on CheckMates for Beginners!
Welcome to Maestro Masters!
Talk to Masters, Engage with Masters, Be a Maestro Master!
ZTNA Buyer’s Guide
Zero Trust essentials for your most valuable assets
The SMB Cyber Master
Boost your knowledge on Quantum Spark SMB gateways!
Check Point's Cyber Park is Now Open
Let the Games Begin!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
CheckFlix!
All Videos In One Space
Hi mates,
I have the following issue to resolve 🙂
Two gateways for company users Remote access with same VPN RA domain configured - working ok.
We need to add third gateway for External Vendors with different VPN RA domain.
All three gateway are defined in the Remote Access community, MEP is turned off.
Everything works, except that external vendors gets the same routing table as defined for company users.
Am I doing something wrong? Is there some manual way to define required routes to be installed for the third gateway.
Thanks
Easy - you can use either two RA communities or Access Roles to get a very granular access policy - see https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_RemoteAccessVPN_AdminGuide/T...
Don't think multiple Remote Access communities are supported. It was possible to create multiple RA communities at one stage, but this was a bug.
Like you said - Identity based policies using Access Roles would be the way to go here.
Yes, i would suggest to use Access Roles. Another possible configuration uses User Groups in access rules.
Thank you for the response, but I don't have issues with rules, but with injected routes on client machines 🙂
As usual it is more complicated than it sounds 🙂
On the first two gw, VPN domain is - All internet without Zoom/Webex services. ( I saw this configuration here somewhere). So clients receive huge routing table that points to the gateway, except for Zoom/Webex.
On the third gw, we want clients to receive only routes to allowed destinations and use their internet services directly, not through the gw. But in fact, they get the same routing tab as members of first two gw.
All remote access vpn domains are defined properly for each gw.
So I was thinking if there is some OS level configuration file that could help for this.
Thanks
Hello,
Check this sk: Remote Access client download routes from all gateways in the Remote Access Community
I think it fits your scenario, and yes, the solution seems to be configured at OS level. HTH.
Regards
Here, no MEP is used, so sk92676 should not apply.
Hello,
I have mep disabled too, but line client_policies still presents mep&# part. Just tested the sk and my routing table decreased from 321 routes to 65. Did not verify that those 65 correspond exactly to the RA vpn domain of the gateway i am connecting too, but think it is worth a try.
Regard
This sk seems promising!
I will try it!
Thanks
I would not suggest such a topology for RA clients. With Access Roles, only parts of the internal networks can be made available to a subgroup of clients.
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY