topic Re: Help me understand split tunneling modes in SASE and Remote Access

Help me understand split tunneling modes

cryptochrome — Tue, 22 Oct 2024 22:51:16 GMT

Hello,

I am having a bit of trouble grasping split tunneling in SASE, as I am getting some contradicting information.

Question:

Does "Full Tunnel" still allow access to the local LAN (directly connected network), or will that traffic be routed to the SASE network?

I have spoken to Support about this and received different answers. Yes, and no.

Assuming it's no, I would have to switch to Exclude mode if I want to avoid local traffic to be routed into the SASE network. In that case, how can I establish cross-site communications?

Example:

Site 1: 192.168.0.0/24
Site 2: 10.10.10.0/24

Two IPSec tunnels, connecting each site to Harmony SASE. Split Tunnel configuration set to exclude both networks, so each network can access local ressources without going through the SASE tunnel.

In that scenario, how would 192.168.0.0/24 communicate with 10.10.10.0/24 (and vice versa), given both are now excluded from the tunnel? Would I set up static routes in the SASE network?

Re: Help me understand split tunneling modes

the_rock — Tue, 22 Oct 2024 23:56:24 GMT

I will let someone else confirm for sure, but my educated guess would be yes, based on below document.

Andy

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/SASE-Admin-Guide/CP_Harmony_SASE_AdminGuide.pdf

Re: Help me understand split tunneling modes

cryptochrome — Wed, 23 Oct 2024 00:51:08 GMT

Thanks Andy. So the routes would override (take precedence) over the split tunnel config? If I exclude 192.168.0.0/24 in split tunnel, but then add a route for the same network, it would work?

It seems a bit counter-intuitive, as that would tell the clients, hey listen, 192.168.0.0/24 is excluded in split tunnel so you can reach your local printer without going through the VPN, but hey, here is a route for 192.168.0.0/24 that sends traffic into the VPN...

In a "classical" network, the locally connected subnet would have a lower metric, so it would always be routed locally, but I am not sure with this one.

Re: Help me understand split tunneling modes

the_rock — Wed, 23 Oct 2024 00:56:32 GMT

I believe thats what the option of "include" and "exclude" is for within the split tunneling setting in sase portal. I dont have access to it atm, but will check it tomorrow and confirm.

I get what you are saying about the routes, its 100% true that in classic network, locally connected subnet would have lower metric.

Andy

Re: Help me understand split tunneling modes

the_rock — Wed, 23 Oct 2024 01:00:14 GMT

I found screenshot I took of it last week. Based on this, Im pretty sure that with full tunnel, EVERYTHING would be routed through the tunnel itself (SASE)

Andy

Re: Help me understand split tunneling modes

cryptochrome — Wed, 23 Oct 2024 10:40:44 GMT

Thanks Andy. So I guess the correct steps would be:

* Exclude local networks in Split Tuneling
* Add routes to these networks in routing config, pointing to tunnel interfaces

I am going to play around with this a bit.

Re: Help me understand split tunneling modes

the_rock — Wed, 23 Oct 2024 11:01:03 GMT

I will check how my colleague and I did it for the customer, but that sounds 100% right. Give me about an hour brother.

Andy

Re: Help me understand split tunneling modes

the_rock — Wed, 23 Oct 2024 11:49:20 GMT

You got it, I just confirmed, though I had a gut feeling thats how it was. I also included post I made about route based tunnels explaining all this and also couple screenshots to help you out. MAKE SURE peer in VTI settings is same as interoperable object, otherwise, it wont work. If you need remote session, happy to help. There is also text file my colleague and I put together few years ago I attached in that post, it lists step by step as far as Azure config.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Route-based-VPN-tunnel-to-Azure/m-p/206179/emcs_t/S2h8ZW1haWx8dG9waWNfc3Vic2NyaXB0aW9ufExTTjlYV1FXMUlGQVNMfDIwNjE3OXxTVUJTQ1JJUFRJT05TfGhL#M38950

P.S. I feel this is important to say...we usually pick UNNUMBERED vti, because this customer uses BGP, but even if someone does not, it would still work, This is somewhat relevant, because some people may "freak out" in such case, when you get interface without topology, you will see vti with EXACT same IP address as interfact it "hangs" off, but its totally NORMAL.

Anyway, thats all I can think of for now mate 🙂

Re: Help me understand split tunneling modes

cryptochrome — Wed, 23 Oct 2024 12:59:03 GMT

Hey Andy, thanks for confirming 🍻 But I think the article/screenshots are related to Gateway/Firewall, not SASE 🙂 But I get the gist of it. Cheers!

Re: Help me understand split tunneling modes

the_rock — Wed, 23 Oct 2024 13:09:25 GMT

Yes, I know, thats on Gaia side, cause on SASE end, all you need to do is make sure you correctly indicate include/exclude options and also networks tab. There is no, per se, routing config you modify.

Andy

Re: Help me understand split tunneling modes

cryptochrome — Wed, 23 Oct 2024 13:27:13 GMT

Hm ok, that kind of puts me back to square one (pardon me, I am slow :D). If all I do is the exclusion, then I still have the problem that once excluded, Site 1 can't talk to Site 2 (and vice versa), as both networks are excluded from the tunnel.

There is a routing config in SASE. It allows me to specify a destination network and the tunnel traffic should flow through.

Re: Help me understand split tunneling modes

the_rock — Wed, 23 Oct 2024 13:45:10 GMT

All good mate, its fairly new to all of us. I cant find anything about it, UNLESS below is what you meant?

Andy

Re: Help me understand split tunneling modes

cryptochrome — Wed, 23 Oct 2024 15:16:05 GMT

Not quite, but this:

There is a routing table. I think this is what I need. It auto-populated for another site that is using the Linux connector rather than an IPSec tunnel.

Re: Help me understand split tunneling modes

the_rock — Wed, 23 Oct 2024 15:22:03 GMT

100% thats what you need, sorry, I was looking at the wrong place, apologies.

Andy

Re: Help me understand split tunneling modes

the_rock — Wed, 23 Oct 2024 15:25:28 GMT

@cryptochrome For the context, in case this may help someone else, this is where it is in the portal.

Andy

Re: Help me understand split tunneling modes

the_rock — Wed, 23 Oct 2024 15:26:57 GMT

Updated screencap 🙂

Re: Help me understand split tunneling modes

the_rock — Wed, 23 Oct 2024 16:46:35 GMT

@cryptochrome

Does it make sense what I mentioned about routing part? If still not clear, please let me know and can test.

Andy