Split Tunnel Domain group

[cdooer]

Hey folks. Wondering if anyone has gotten this working yet, and are using it in a production environment?  I've tried following the instructions laid out in this document;  https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_RemoteAccessVPN_AdminGuide/Content... , but when I attempt to add the domain group to the VPN group, I get 

I've got a call open with TAC, thought I'd post it here as well just in case anyone had any ideas while TAC gets around to looking at it. Running R81.20. 

[the_rock]

Can you send a screenshot of what it looks like at the moment?

Andy

[the_rock]

I can easily test it in R81.20 and R82 to see if any difference.

Andy

[CaseyB]

What does your group look like? It did not give me any fuss in R81.20 JHF 89.

[the_rock]

Yep, I tested the same, worked fine.

Andy

[cdooer]

Strange indeed, here is mine

[the_rock]

Just accept it and see if policy works.

Andy

[cdooer]

Fails immediately. 

[CaseyB]

The names of groups don't line up between your screenshot and the validation error, so I feel like I'm missing something.

Are you nesting the earlier "VPN" group under the "Encryption.Domain" referenced in the validation error? 

[cdooer]

See screenshots below.

[the_rock]

Make sure group you are adding has name exclusions_

Andy

[PhoneBoy]

What EXACTLY are you configuring as your RemoteAccess encryption domain?
This should be a group object that includes the exclusions_ group you've created.

[cdooer]

The Remote Access encryption domain is a group with exclusions;

This group looks as follows;

And the main group (non excluded) looks like this;

[the_rock]

Just do how @CaseyB  did it. I did it same way and it worked.

Andy

[cdooer]

The problem is that's how we do traditional IP based split tunneling, which I don't want to break. 

[CaseyB]

You can leave the gateway encryption domain as is.

• Make a new group that has all the IP addresses in it for RemoteAccess that you want
• Add the exclusions_ group to that
• Use the granular encryption domain for the RemoteAccess community

This will only effect stuff using that RemoteAccess community.

You could just clone the group you are using already and just remove the objects you are doing the exclude on.

[cdooer]

So what's the difference between these two settings? I always thought they did the same thing;

[CaseyB]

I am using my screenshot below for reference.

• Section 1 - This is the default VPN domain for the gateway. RemoteAccess VPNs and IPsec VPNs will use this by default. It is a shared pool.
• Section 2 - This is where you can create a more specific VPN domain for that IPsec VPN or RemoteAccess VPN. I highlighted objects that say, "According to the gateway", that means those VPNs use the encryption domain from section 1. Everything else is using their own specific group with a much more defined encryption domain.

Based on your new screenshots, you should just be able to add your "exclusions_" group to the group "VPN_Exclusion_Domain".

[the_rock]

Thats exactly how I tested it as well.

Andy