topic Re: Force VPN Checkpoint in SASE and Remote Access

Force VPN Checkpoint

ELKAMO — Wed, 12 Aug 2020 16:07:40 GMT

Hi,

Is there a way to force users to connect to Checkpoint VPN without using GPO ? That means users can't use Internet unless they are connected to VPN. I have read that many other VPN offer a called VPN Kill switch fonction, does Checkpoint offer a similar one ?

Than you in advance

Re: Force VPN Checkpoint

AlejandroH — Wed, 12 Aug 2020 18:14:50 GMT

There is a feature called “always on”. It was discussed on this thread.

https://community.checkpoint.com/t5/Remote-Access-VPN/Endpoint-VPN-and-auto-connect/td-p/47055

Re: Force VPN Checkpoint

PhoneBoy — Sun, 16 Aug 2020 01:35:41 GMT

In addition to always on, you will need to configure the firewall policy on the client to block most traffic when disconnected from the VPN.
This requires a full Endpoint license as the Desktop Firewall is only supported with that license.

Re: Force VPN Checkpoint

ELKAMO — Wed, 09 Sep 2020 16:28:10 GMT

Thank you very much for your response.

Re: Force VPN Checkpoint

Simply_sachin — Wed, 18 Nov 2020 06:30:04 GMT

Hi Phoneboy,

I would like to try this out. What kind of policy / rule i should push to deny rest of the traffic but uses end point VPN traffic ?

Re: Force VPN Checkpoint

Simply_sachin — Wed, 25 Nov 2020 06:04:15 GMT

Hi Phoneboy,

Any advice ?

Re: Force VPN Checkpoint

PhoneBoy — Wed, 25 Nov 2020 06:46:25 GMT

Recommend reading the ATRG for Endpoint Firewall: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk164253&partition=Basic&product=Endpoint

Re: Force VPN Checkpoint

Agent_Smith — Fri, 07 Apr 2023 18:33:40 GMT

Is there a way to do this when a user is not VPN block all network access? I was looking and saw that there are inside and outside network options for defining rules. However I'm not sure what defines inside or outside network. If it is just communication with the management station without VPN then this will not accomplish what we want. What is a rule set where we can force VPN, and allow no other traffic unless VPN. I was thinking along the lines of getting an office mode IP then traffic opens, or if the client knows the user isn't VPN then deny all

Re: Force VPN Checkpoint

Chris_Atkinson — Fri, 07 Apr 2023 23:21:27 GMT

One option might be to look at the "Disconnected" policy, which is enforced when the client cannot talk to the Endpoint Management.