Encryption domain - object types

[babicmilan]

Hello,

I'm interested in Site to Site VPN local and remote encryption domain object types.

In some situations I have noticed that VPN Phase 2 doesn't work if I use in local and remote encryption domain objects type "host"

Lets assume:

Group_local_encryption_domain:

• 10.255.1.0/24 (object type network)
• 192.168.10.5 (object type host)
• 10.1.1.10 (object type host)

If I change objects type "host" to be "network" objects with mask /32 Phase 2 is up and everything works fine.

Group_local_encryption_domain:

• 10.255.1.0/24 (object type network)
• 192.168.10.5/32 (object type network)
• 10.1.1.10/32 (object type network)

Please, can someone confirm me that objects inside local or remote encryption domain must be type "network"?

Best regards.

[PhoneBoy]

IPSEC Tunnels are negotiated typically based on subnet, not host (though it's configurable).
That implies the use of network (not host) objects.