I would ask you how to resolve the below problem.
At the moment we use 6 Check Point gateways for our VPN Remote Access system.
Each gateway has dedicated Office Mode pool:
gw05 Office Mode Pool 10.76.0.0/19
gw01 Office Mode Pool 10.76.32.0/19
gw03 Office Mode Pool 10.76.64.0/19
gw06 Office Mode Pool 10.76.128.0/19
gw02 Office Mode Pool 10.76.160.0/19
gw04 Office Mode Pool 10.76.192.0/19
Despite that each pool has 8190 IP addresses it is not enough for us. We need to double each pool.
Of course we can change subnet mask to /18 but we don’t want do it. Instead of this we looking for solution where we will use two pools (each of them with subnet mask /19). When the first pool will be full IP address should be assigned from second pool
It should looks like this:
gw05 Office Mode Pool 10.76.0.0/19 and 10.77.0.0/19
gw01 Office Mode Pool 10.76.32.0/19 and 10.77.32.0/19
gw03 Office Mode Pool 10.76.64.0/19 and 10.77.64.0/19
gw06 Office Mode Pool 10.76.128.0/19 and 10.77.128.0/19
gw02 Office Mode Pool 10.76.160.0/19 and 10.77.160.0/19
gw04 Office Mode Pool 10.76.192.0/19 and 10.77.192.0/19
At the moment we use “Manual method” for Office Mode
In this method it is possible indicate only one pool / network so we decided to use ipassignment.conf file with content like this:
Because this is new configuration for us, so we decided to test it in our lab.
Of course we hadn’t possibilities to conduct that test in that scale like in production environment, so ipassignment.conf file in our lab looked like below.
The test was that 3 clients try to connect to VPN and the results was like below:
Client-1 get address 10.76.0.4
Client-2 get address 10.76.0.5
Client-3 didn’t get address (screen below)
So my questions are:
- could you confirm that is any method to use two pools (on one gateway) in Office Mode
- if answer on above question is “YES” how should it be done
The software we used during the tests is:
Check Point R80.40 take 294 (HFA take 139)
Endpoint Security E85.40
Thanks in advance