topic Re: Full tunnel over SSL VPN/SNX in General Topics

Full tunnel over SSL VPN/SNX

Martin_Raska — Wed, 04 Sep 2024 09:44:02 GMT

Hello,

I am seeking advice how to configure Split/Full tunnel per user/user group. The connection to VPN is over SSL portal SNX extender.

Something like this.

FW-A

user group - A : full tunnel, no split tunneling

user group - B : split tunneling only

FW-B

user group - C : full tunnel, no split tunneling

user group - D : split tunneling only

environment is Multidomain with VSX and Maestro.

Thanks

Re: Full tunnel over SSL VPN/SNX

samir-brkic — Wed, 04 Sep 2024 10:01:30 GMT

could you please provide more details on the purpose of configuring split/full tunneling per user/user group in your SNX SSL portal setup?

Could you please clarify whether you are using the Unified Access Policy or the Legacy Policy for your SSL rulebase?

Typically, with SNX SSL connections, when using the Legacy Policy, full tunneling may not be necessary as access is restricted to the specific applications allowed in the rulebase. This setup usually ensures that routing is managed according to the applications rather than requiring split or full tunneling.

Re: Full tunnel over SSL VPN/SNX

the_rock — Wed, 04 Sep 2024 13:11:55 GMT

Last time I asked TAC about it, they said it was not possible/supported.

Andy

Re: Full tunnel over SSL VPN/SNX

PhoneBoy — Wed, 04 Sep 2024 17:31:17 GMT

For the full Endpoint client, you can do something like this: https://support.checkpoint.com/results/sk/sk114882
Not sure you can do this with SNX, though.

Re: Full tunnel over SSL VPN/SNX

Martin_Raska — Thu, 05 Sep 2024 08:46:31 GMT

Purpose is sell it in the same way as other competitors services (PA,FG) whos have solution for that.

Re: Full tunnel over SSL VPN/SNX

Martin_Raska — Thu, 05 Sep 2024 08:46:49 GMT

I thought so.

Re: Full tunnel over SSL VPN/SNX

the_rock — Thu, 05 Sep 2024 11:18:46 GMT

You nailed it with that statement, could not agree more.

Andy

Re: Full tunnel over SSL VPN/SNX

OliverBayerlein — Tue, 10 Sep 2024 14:27:48 GMT

Probably there is no full tunnel / hub mode in SNX but you can follow sk32111 Configuring Different Encryption Domains for Different User Groups in SNX and try a "All Internet" Group as Encryption Domain to get a full tunnel for specific user groups.