Limiting OfficeMode to a LDAP Group with AD Computer objects inside

[Teddy_Brewski]

Hello,

I'm working on a new gateway that will allow VPN connectivity based on machine certificates and would like to limit OfficeMode to a LDAP group that contains AD computer objects from our Active Directory.

Defining 'Only Group in branch' and specifying the relevant group in the LDAP Group object does exactly what I need, but my question is: do I need to push the policy every time the AD group is modifed or the AD will be queried each time there is a VPN  connection attempt?  I tried to add a couple of computer objects in the AD group and connect and get an error 'User not in Office Mode group'.  The moment I pushed the policy -- it worked.

PS: VSX R80.40 (latest take)

Thank you.

[PhoneBoy]

It may be that information was cached that got "cleared" with a policy install.
Or, if you waited some time, it would update.
In any case, this may require a TAC case to investigate: https://help.checkpoint.com