We have had a similar issue. We have a site to site VPN setup with an external site.
Servers needing access are defined on the if via rule. Encryption domain on our side includes subnets at my site. The difference lies, in that the web server we try to get to is on the external site's network. We could not get to their website. I believe the packet was dropped. Reason was that the website was included in the encryption domain of the external site and CheckPoint would include it in the VPN rule and this site did not have access via the rule and would get dropped. We found out that we had defined the encryption domain for the external site incorrectly. Once we corrected this, they were able to access the website. So I believe that if your webservers are included in your encryption domain you will see the same issue. It is possible that you could create a network object with your defined subnets for the encryption domain, and then use a negate group to negate the web server from the encryption domain, and apply this to the topology. But of course this has other issues...where you need the web server as part of the encryption domain. Another thing you could try is include this webserver as part of the site to site VPN with the other site, then instead of them coming cleartext to the site, they would come through the VPN. Derek O'Flynn Enterprise Information Security LSU Health Sciences Center [EMAIL PROTECTED] (504)568-6130 -----Original Message----- From: Ray Pesek [mailto:[EMAIL PROTECTED] Sent: Monday, June 07, 2004 1:33 PM To: [EMAIL PROTECTED] Subject: [FW-1] Remote Access encryption domain versus site-to-site encryption domain We have our entire internal network defined as being in the encryption domain for remote access use. We also have a frame connection to a partner that terminates on a server in the encryption domain. We want to replace it with a site-to-site Simplified VPN. They're running a WatchGuard 7.0 Firebox III system. We got the VPN up and running OK but we have one oddity. We also have a web server on our internal network (in the encryption domain) that is accessible from certain IP addresses on the Internet. It is also used by this partner. When the partner tries to access the web server from the Internet, the connection is dropped as a cleartext packet in an encrypted connection. If I exclude HTTP from the Simplified Community, it works OK. It appears that the Remote Access and Site-to-Site encryption domains cannot be separated at all even though the rule that has the "if via" objects in Source and Destination only specifiy a particular IP address. I was thinking that if the "if via" rule did not specify the IP address of the web server, and it doesn't, then traffic to the web server would not have to go down the tunnel as well. The VPN server and the web server are only one digit different in IP addresses, if that matters. Can anyone shed some light on whether this behavior is correct? That if traffic originates from a Simplified VPN satellite gateway, then all traffic to any IP contained in the encryption domain must be encrypted even if the rule base does not specify this? R55, by the way. Thanks, Ray _________________________________________________________________ Check out the coupons and bargains on MSN Offers! http://youroffers.msn.com ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
