> Source: [sk182946](https://support.checkpoint.com/results/sk/sk182946)

# sk182946 - VPN tunnel negotiation uses incorrect VPN domain, ignores the EDPC settings

| Property | Value |
|----------|-------|
| Solution ID | sk182946 |
| Date Created | 2024-12-20 |
| Last Modified | 2024-12-23 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS) |
| OS | Gaia |
| Platform | 6000 |

## Symptoms

- * ?Encryption Domain Per Community (EDPC) is a feature that allows different VPN communities to have distinct encryption domain settings. It enables defining specific IP ranges for each community. This ensures that VPN traffic is encrypted based on the correct policies and avoids overlap between different communities' encryption domains.
* The VPN tunnel negotiation uses the subnet `10.0.0.0/8` instead of the configured `10.37.0.0/28` for the peer gateway's VPN Domain in the VPN community.
* The VPN Kernel debug shows messages indicating an incorrect range is applied during negotiation:

  > `calc_complex_ip: There is EDPC on this gw on other community, fetch values from vpn_local_ranges table: rangestart-10.0.0.0, rangeend-10.255.255.255;
  > vpn_get_outbound_tunnel_ids_cpip: The tunnel ID's are: SRC:10.2.1.101-10.2.1.101, DST:10.0.0.0-10.255.255.255;
  > `

  Explanation: These logs confirm that the VPN negotiation applies an incorrect range (`10.0.0.0 - 10.255.255.255`) instead of the expected subnet (`10.37.0.0/28`).
* The compiled policy `.pf` file on the Security Management Server shows the VPN Domain as `10.0.0.0/8` instead of the expected `10.37.0.0/28`:

  > `all@ vpn_enc_domain = { <10.0.0.0, 10.255.255.255>, .... };
  > all@ vpn_enc_domain_valid = { <10.0.0.0, 10.255.255.255>, .... };
  > all@ community_domain_38 = { <10.0.0.0, 10.255.255.255>, .... };
  > `

  Explanation: The applied VPN Domain in the VPN community reflects the incorrect range, which leads to mismatched VPN Domain settings during tunnel negotiation.

## Cause

The **VPN Domain** for the gateway is set to "**All IP addresses behind Gateway based on Topology information"** . The subnet `10.0.0.0/8` is defined behind the internal interface in the Topology settings.

![VPN Domain is set to All IP addresses behind Gateway based on Topology information](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1734729969428/InkedVPN_Domain1_LI202412201556053.jpg)

The local VPN Domain overlaps with the remote VPN Domain. Due to this overlap, the policy uses the largest subnet (`10.0.0.0/8`) from the local VPN Domain instead of the EDPC settings.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content