Configure encryption domain to allow specific users access from a different subnet

[Daniel_Bourne]

Folks,

We have a local company network that uses the subnet 192.168.0.1/23 in our office.  All devices, domain controllers, etc are on this subnet as are all the office laptops, wifi, etc.  We have about 30 site to site VPN's created from our Checkpoint 5100's  that have our encryption domain as 172.16.3.0/24.  What we would like to do is to allow some of the users in the 192.168.0./23 subnet the ability to get an IP address in the 172.16.3.0/24 network so they can access devices on the remote site to site VPNs.

Since all of our users are on DHCP, what would be the easiest way to configure this on the 5100 Appliance? (R80.20) I was thinking NAT rules would be the simplest, but this would mean manually assigning IP addresses for all the users who need access.   I also cannot change the encryption domain to  our office subnet (192.168.0.1/23) as I don't want everyone to have access.

Am I missing something here or does anyone have any suggestions?

[PhoneBoy]

What’s the topology behind the 5100 with respect to these two subnets?
I suspect static DHCP assignments plus NAT rules is probably the only way to do this.

[Daniel_Bourne]

Behind the 5100, we have :

192.168.0.1/23  - office network, wifi, domain controllers, etc.

172.16.3.0/24 - Encryption domain for site to site VPNs

10.x.x.x - Engineering servers

Right now the way users access the encryption domain is by connecting to a local RRAS server which authenticates their account and gives them an IP on the 172.16.3.0/24 network (locally or remotely).  This then allows them to have access through some or all of the site to site VPN's using that encryption domain.  This is messy and we would like to get rid pf the RRAS server.  I know there is a lot going on here and I think it is more about improper network design, etc.  However, I was thinking there must be a way using our Checkpoint gateway to allow some users in 192.168.0.1/23 to use an IP in the 172.16.0.0/24 network.  You might be right about fixed IP's and NAT rules but that is a lot of work for me! 

[PhoneBoy]

If you're currently using RRAS to do it, you could achieve something similar with Remote Access VPN on the Check Point gateway.