> Source: [sk105638](https://support.checkpoint.com/results/sk/sk105638)

# sk105638 - Traffic from Remote Access client failing to match any Security Gateway's encryption domain

| Property | Value |
|----------|-------|
| Solution ID | sk105638 |
| Date Created | 2015-04-10 |
| Last Modified | 2016-12-07 |
| Technical Level | Advanced |

## Symptoms

- * Traffic from Remote Access client failing to match any Security Gateway's encryption domain.
* "Partial overlapping encryption domain" error messages upon policy installation / verification.
* The signature line in trac.log on the client side is:  
  \[ 1636 1380\]\[25 Mar 19:38:16\]\[TR_CL_SETTING_MGR\] TrClSettingManager::UpdateTopologyInConf: ERROR: not supported: encdom id 1 is partially overlapping with encdom id 0  
* Full fwmonitor string is observed in the connection. (i , I, o, O)

## Cause

**Encryption domain overlap exists between different Remote Access community encryption domains.**

If the Remote Access encryption domain overlaps, for example, suppose network x.x.x.x exists in both Remote-1-internal and Remote-2-internal and network y.y.y.y only exists in Remote-1-internal, then you'd have partial overlapping.

Either ALL of Remote-2-internal should be a proper subset of Remote-1-internal, or they can be identical (each is a full subset of the other).

Refer to the diagrams at the bottom of the page.

![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1428627447738/remote-11504091816.png)

![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1428627447738/remote-21504091817.png)

**Problematic VPN domain**

(Diagram comes from: <http://commons.wikimedia.org/wiki/File:Venn_A_intersect_B.svg>)

![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1428627447738/subset1504091810.png)

**Good VPN domain**

* (Diagram comes from: <http://commons.wikimedia.org/wiki/File:Venn_A_subset_B.svg>)  

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1428627447738/goodsubset1504091818.png)
* Another "Good" configuration exists where A \^B = �  
  (Diagram comes from: <http://en.wikipedia.org/wiki/Disjoint_sets#/media/File:Disjunkte_Mengen.svg> (Thanks to Stephan Kulla)

  <br />

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk105638/Good_Config1504152332.png)

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content