topic selective split tunneling based on destination in SASE and Remote Access

selective split tunneling based on destination

flachance — Thu, 02 Apr 2020 17:37:11 GMT

R80.30

Split Tunneling is currently disabled.

Is there a way to enable it only for certain destinations? Like when going to youtube or if using Teams?

thanks

Re: selective split tunneling based on destination

PhoneBoy — Fri, 03 Apr 2020 00:57:33 GMT

By definition Split Tunneling means "route some traffic across VPN and route everything else to the Internet directly."
Route All Traffic means exactly that with the local subnet as a possible exception to this rule.
What you probably want is a Remote Access domain that contains everything BUT specific web-based applications.
Currently, we don't offer an easy way to create that.

Personally, I'm not a fan of the "Route All Traffic" approach as it doesn't really scale.
You can get visibility and protection for the Endpoint by deploying the appropriate controls.
Better yet: They don't require you to be connected via VPN for them to apply.

Re: selective split tunneling based on destination

remi0403 — Mon, 08 Jun 2020 05:12:34 GMT

Hi
This was discussed in https://community.checkpoint.com/message/20006-re-exclude-subnet

Re: selective split tunneling based on destination

PointOfChecking — Thu, 15 Apr 2021 12:34:54 GMT

That discussion was for a reverse of this question.

I have a similar issue as this. However, mine is more simpler, we don't need for specific web-based applications, just specific IP addresses.

Re: selective split tunneling based on destination

PhoneBoy — Thu, 15 Apr 2021 16:06:50 GMT

The encryption domain is IP addresses in the end.
Basically you’d be creating an encryption domain for everything except for the IPs in question.
Similar to this (except you’d define the specific IPs to exclude): https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk167000&partition=Basic&product=IPSec

Re: selective split tunneling based on destination

PointOfChecking — Thu, 15 Apr 2021 16:11:04 GMT

Thanks for the pointers! Got it.

Re: selective split tunneling based on destination

Rene_Moeller1 — Tue, 14 May 2024 16:01:01 GMT

Hi,

Unfortunately, the sk167000 described here does not work for Quantum Sparc Gateways. No matter what I configure, an exception group does not work and is ignored. I have not found any limitations. Do you know of any or is there a trick to circumvent this limitation?

Management Version R81.20 JHF Take53
Gateway: 1595W5G R81.10.10 Build 2906

Thank you.

Re: selective split tunneling based on destination

PhoneBoy — Tue, 14 May 2024 17:04:34 GMT

Likely will need a TAC case to confirm this is a bug or an RFE that should be addressed via your local Check Point office: https://help.checkpoint.com