SMB spark encryption domain not functioning correctly

[Diyaa3791]

Hello everyone,

I am wondering why the Check Point SMB remote access VPN is acting this way. This gateway is running R81.10.07 (996001397)

The encryption domain has the following subnet in it (highlighted in red). The VPN is pushing every single IP of every single interface on the SMB gateway and the encryption domain subnet (highlighted in pink).

Has anyone seen this behavior before? Maybe there is an SK that I can't find about this?

Thank you in advance,

Diyaa

[PhoneBoy · Accepted solution]

The gateway (including all IPs) is always included in the encryption domain by default.
To disable this, see: https://sc1.checkpoint.com/documents/SMB_R81.10.X/CLI/EN/Content/Topics/set-vpn-site-to-site-no-loca... 

[Diyaa3791]

Thank you so much. This answers my question.