Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
khodgson_bts
Contributor
Jump to solution

Domain objects in remote access encryption domain.

Hello all!

 

Just completed an upgrade of management to R81.20 from R81.10. It manages 3 x clusters currently running on R80.40 (upgrade imminent).

One of the clusters is used for the remote access VPN, and now when pushing policy we get the following error:

"You can use updateable objects, dynamic objects and domain objects in a Remote Access VPN community only as members of a network group whose name starts with 'exclusions_'. The group whose name starts with 'exclusions_' must be a member of another network group."

There is only one domain object in use and I've tried this workaround and it still fails. The only way to get a successful policy installation is to remove the domain object from the RA encryption domain entirely.

TAC have not been much use so far.

Any ideas?

0 Kudos
1 Solution

Accepted Solutions
khodgson_bts
Contributor

So it seems that it's only supported in gateways from R81.20.

MicrosoftTeams-image (4).png

Why it didn't give this error message in the production environment I don't know.

View solution in original post

0 Kudos
9 Replies
the_rock
Legend
Legend

Hey,

Can you send a screenshot please? I can try it in my lab and report back.

Best,

Andy

0 Kudos
khodgson_bts
Contributor

OK so this seems to be expected behaviour (working as intended). Domain objects are not permitted in the encryption domain for an remote access VPN except in a very specific scenario detailed here.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/C...

Clearly this has never worked, but until now it's not really been flagged up or enforced during a policy installation.

0 Kudos
the_rock
Legend
Legend

This part is actuallly true, just tested it.

Andy

"You can use updateable objects, dynamic objects and domain objects in a Remote Access VPN community only as members of a network group whose name starts with 'exclusions_'. The group whose name starts with 'exclusions_' must be a member of another network group."

0 Kudos
khodgson_bts
Contributor

We couldn't get that to work. Is it possibly due to the gateways still being R80.40?

0 Kudos
the_rock
Legend
Legend

Not sure, but it might be only possible in R81+

Andy

0 Kudos
khodgson_bts
Contributor

Would you mind screenshotting what you've done so I can compare it to what we have please?

0 Kudos
the_rock
Legend
Legend
 
khodgson_bts
Contributor

So it seems that it's only supported in gateways from R81.20.

MicrosoftTeams-image (4).png

Why it didn't give this error message in the production environment I don't know.

0 Kudos
the_rock
Legend
Legend

Not sure, but it would seem so.

Best,

Andy

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    Tue 23 Apr 2024 @ 11:00 AM (EDT)

    East US: What's New in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82

    Tue 23 Apr 2024 @ 11:00 AM (EDT)

    East US: What's New in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82
    CheckMates Events