> Source: [sk36510](https://support.checkpoint.com/results/sk/sk36510)

# sk36510 - Remote Access Client, connected to Security Gateway, cannot pass traffic to peer VPN Gateway's encryption domain via Site-to-Site VPN

| Property | Value |
|----------|-------|
| Solution ID | sk36510 |
| Date Created | 2008-12-12 |
| Last Modified | 2024-06-07 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- VPN Client, connected to a Security Gateway, cannot pass traffic to a peer VPN Gateway's encryption domain with Site-to-Site VPN.

## Cause

The required settings are not configured (Encryption Domains and additional settings).

## Solution

### How to allow Client to Site Traffic over Site to Site VPN Tunnel (C2S2S)

**Example scenario:**   

On a network (LAN1), a Remote Access VPN Client connects to VPN Gateway #1 (GW1).

There is a Site to Site VPN between VPN Gateway #1 (GW1) and VPN Gateway #2 (GW2).

It is necessary to sent traffic from the network LAN1 to the network LAN2 behind VPN Gateway #2.

Logical diagram:

LAN1 with a RA VPN Client == (RA VPN) == \[GW1\] == (Site-to-Site VPN) == \[GW2\] === LAN2

**Notes about Hub Mode:**

* If Hub Mode is **disabled** (this is the default), then modifying the Remote Access Encryption domain (step2) to include the Site-to-Site domains below is **mandatory.**
* If Hub Mode is **enabled** , then modifying the Remote Access Encryption domain (step2) below is **recommended**. If in the future you enable Hub Mode, users do not lose access to resources behind VPN Gateway #2. With Hub Mode enabled, the client sends all traffic to the gateway.

**Notes about the S2S domains:**

* The Office mode IP pool must be part of the local gateway's encryption domain \[example GW1 domain\].
* You can have Office mode hidden behind a NAT before encryption over to the peer's domain if NAT is allowed in the Tunnel. Be sure to included pre and post Nat in the local domain \[GW1 domain\].
* If the Peer is a 3rd party device, be sure the peer is configured to receive/expect any additional network ranges.

<br />

**Configuration Procedure:**

In our example, we uses these IP addresses:

* Network IP address for Office Mode: 10.10.10.0/24
* Network IP address for the Encryption Domain of VPN Gateway #1 ("GW1_ENC_DOMAIN"): 192.168.10.0/24
* Network IP address for the Encryption Domain of VPN Gateway #2 ("GW2_ENC_DOMAIN"): 192.168.30.0/24

1. In the Security Gateway object for GW1:

   1. In the left navigation tree, click **Network Management** \> **VPN Domain**.

   2. Select **User defined**.

   3. Click the **...** icon.  
      A menu opens with a table of VPN domains.

   4. Do **one** of these:

      1. Click **New...** \> **Group** \> **Simple Group...**

      2. Click **New...** \> **Group** \> **Group with Exclusion...**

   5. Create a Group that includes the encryption domain of GW1 (in this example, 192.168.10.0/24) **and** the Office mode pool network (in this example, 10.10.10.0/24).

   6. In the dropdown menu next to **User defined**, select the new Group.

   7. Click **OK** .  
      The Security Gateway object window closes.

2. In the Security Gateway object of GW1:

   1. In the left navigation tree, click **Network Management** \> **VPN Domain**.

   2. Next to **Set Specific VPN Domain for Gateway Communities** , click **Set...**

      The **Communities Specific VPN Domain** window opens.
   3. Double-click on the **Remote Access Community** .  
      The **Set Specific VPN Domain for Community** window opens.

   4. Select **User defined**.

   5. Do **one** of these:

      1. Click **New...** \> **Group** \> **Simple Group...**

      2. Click **New...** \> **Group** \> **Group with Exclusion...**

   6. Create a group that includes the encryption domain of GW1 (in this example, 192.168.10.0/24) and the encryption domain of GW2 (192.168.30.0/24).

   7. Click **OK** .  
      The Communities Specific VPN Domain window closes.

   8. Click **OK**.

3. In the Access Control policy, make sure the rule that accepts the Office mode pool through Site to Site VPN has the "VPN Community" set as "Any".

4. Install policy on the side.

5. Install policy on the client side.

6. Test the results.

<br />

**Notes**   

* To allow GW2 RA users to access GW1 encryption domain, configure the encryption domain of GW2 so that it does not include the Office mode pool network. Then, configure GW1 the same as you configured GW2 in the procedure above.
* If both Security Gateways are in the Remote Access Community, you must disable Secondary Connect. If you do not disable Secondary Connect, traffic goes directly from the VPN client to the remote Security Gateway, and does not pass through the Site-to-Site tunnel.

**Limitations** In a Maestro environment, this is only supported after R81.10 per [sk173183](https://support.checkpoint.com/results/sk/sk173183).  

**Additional considerations for SSL Network Extender**

1. Create a Native Application for traffic from client to server. For more information, see the [Mobile Access Administration Guide](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=documents&product=72) for the relevant version \> "Native Applications for Client-Based Access" section.

2. Create a Native Application for traffic from server to client.Note: For each Native Application for client-server traffic, you must configure the same Native Application for server-client traffic.

3. Make sure there is a policy rule that allows the Native Application(s) for client-to-server traffic and server-to-client traffic.

4. Make sure the Mobile Access policy rules allow the traffic from the Native Application(s) for client-to-server traffic and server-to-client traffic.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content