How to define Remote Access VPN on Check Point Gateway

[JohnnyWang]

Hi everyone,

I currently have a case that I’m not sure how to handle yet, and I’d like to ask if anyone who has configured a similar setup could share your experience.

Here’s the situation:

• I have two separate Security Gateways (SGs) managed under the same SmartConsole. Both devices have Remote Access VPN configured. Each gateway is assigned an external DNS for access as follows:
  GW1: vpn03.cybertest.com.vn
  GW2: vpn04.cybertest.com.vn

The issue I’m facing is that when a user connects successfully to vpn03.cybertest.com.vn, performing a tracert shows that the connection is actually coming from the public IP of GW2. I’m not sure if this behavior is related to some kind of load balancing.

Currently, we have not enabled the load balancing feature in Global Properties. I’m considering whether I should apply the define MEP topology configuration and switch it to client_decide, since I want each user to connect to the specific VPN configured on the gateway we designate.

:automatic_mep_topology ( :gateway ( :map ( :true (true) :false (false) :client_decide (client_decide) ) :default (true) ) )

Additionally, if the VPN domain is shared between both gateways, could that cause this behavior? Or should we create a separate VPN domain for each gateway?
Looking forward to everyone’s thoughts and suggestions.

[the_rock · Accepted solution]

I would say way to go here is to define different remote access vpn domain for each firewall.

[Duane_Toler]

Can that be done?  Last time I looked at defining multiple RA communities it failed to install the policy.

EDIT:  Or did you just mean VPN domains per gateway, all within the same RA community?

[the_rock]

Hey Duane,

Maybe I misspoke or did not explain it right. I meant DIFFERENT ra vpn domains for separate firewalls. Defining multiple remote access communities never worked, would give en error if you try to save it.

[Duane_Toler]

AH, ok. Yes, that might be what the OP needs to do.

[the_rock]

Thats my thought as well.

[PhoneBoy]

Actually, I was able to do it in an early R80.x version...and yeah, it's was a UI bug, since this configuration is NOT supported. 

[the_rock]

Funny you mentioned that, I totally remember lol, it worked for 1 day I believe.