Domain objects in remote access vpn domain

[the_rock]

Hey guys,

I really hope someone can confirm this for me, because I find it a bit confusing. Its reference to below post:

https://community.checkpoint.com/t5/General-Topics/Domain-objects-in-remote-access-encryption-domain...

So, my colleague and I did it the same way for a client last week and worked like a charm, we added 2 domains in new group called exclusions_ and then added that group to RA vpn domain, pushed policy, tested after reconnecting to their VPN, no issues!

Then, we followed the same for another client, but was failing, could be the site, not sure. Then, we opened TAC case and were told this is NOT supported, to add domains to vpn domain and exclusions group is to exclude things, not include them, though not sure this is officially documented anywhere, at least that I was able to find.

Here is my logic about it...to me personally, does not matter what group is called, as long as it belongs to the vpn domain, there would be no reason not to work. To exclude something, from my experience, you would simply add group with exclusions.

Or am I missing this completelly?

Thoughts? 🙂

Tx as always!

Andy

[G_W_Albrecht]

Documented here: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/C...

[the_rock]

I know that link, thats same one from the original post, but I dont see anywhere there stating that this is not supported.

Andy

[the_rock]

Quick update. TAC gave us below sk, but Im not sure if it is applicable in this case, but maybe someone can confirm. Anyway, we will test this ourselves in customer's environment to see if we can get it working.

Andy

https://support.checkpoint.com/results/sk/sk142832

[the_rock]

Latest update:

Confirmed with R&D that adding domains is indeed supported and what I attached proves it as well.

Andy

[the_rock · Accepted solution]

Issue fixed. It was the method using group that starts with exclusions_ that needed to be added to RA vpn domain, but appears was website issue.

Andy