Can we have different encryption domain in STAR S2S VPN topology

[Kjohnt006]

Hi Team,

We have multiple tunnels on Checkpoint 15000 firewall configured in STAR topology. as attached in snap "VPN Topology".

For all the tunnel we have one encryption domain configured in Center Gateway. this group covers almost all the subnets. basically, it is wider group contains lots of subnets (many more subnets including exact encryption domain IPs).

We are facing issue on one of the tunnels and we want to replace wider group with specific subnets at our end in center gateway encryption domain. 

can we do it? will it impact other tunnels?

please find the attached pics.

[Lesley]

On the vpn community itself you can configure custom local and remote encryption domain. Works the same as global encryption domain under the gateway object. Only difference is that the change will only have effect on the community itself and not on a global level

[the_rock]

 There you can set whatever group/subnet you desire and if needed, just create new one and assign it, install policy and thats it.

Andy

[Kjohnt006]

Hi Andy, thank you for the input... just a query, if I will change only for one community, wont it impact other communities?

[the_rock]

Thats right, it never impacts any other communities. Thats a beautiful thing since R80 that you can do this, as it was not possible via smart console back in R77 and before.

Andy