topic Re: Excluding VPN Client from Forcepoint cloud proxy in SASE and Remote Access

Excluding VPN Client from Forcepoint cloud proxy

Spectrumtech_MS — Thu, 19 Mar 2020 12:33:05 GMT

Hello all,

We have recently deployed forcepoint cloud proxy agents on our PC fleet.

It seems that the proxy agent intercepts Checkpoint VPN clients and preventing it from establishing a remote access tunnel (IPSEC),

Does anyone have a list of the VPN executable that need to be excluded fro the proxy policy ? Or prhaps a solution to allow VPN client to connect via the Forcepoint proxy ?

Thanks in advance !

Re: Excluding VPN Client from Forcepoint cloud proxy

Maarten_Sjouw — Thu, 19 Mar 2020 12:57:35 GMT

Exclude the https://<IP of Gateway> in the proxy should do the trick.

Re: Excluding VPN Client from Forcepoint cloud proxy

Spectrumtech_MS — Thu, 19 Mar 2020 13:06:24 GMT

tried that but it doesn’t seem to work ..

Re: Excluding VPN Client from Forcepoint cloud proxy

PhoneBoy — Sun, 22 Mar 2020 02:05:27 GMT

It sounds like the Forcepoint client is acting like a VPN client and there is bound to be conflicts when you have two or more VPN clients on the same box.
Our VPN client has executables but I assume most of the transmission is happening at the driver level.

Re: Excluding VPN Client from Forcepoint cloud proxy

Spectrumtech_MS — Sun, 22 Mar 2020 09:54:38 GMT

So it turns out that excluding the VPN gateway's IP address, as suggested by Maaten, rather than its DNS name (as we were using) did the trick !

Thank you !

Re: Excluding VPN Client from Forcepoint cloud proxy

pbedel — Mon, 25 Sep 2023 14:57:26 GMT

This didn't solve the problem, I did add an exception on the forcepoint FSM proxy but I still have a block to mount the tunnel from a client workstation.

Re: Excluding VPN Client from Forcepoint cloud proxy

pbedel — Wed, 27 Sep 2023 09:20:57 GMT

Thanks for your feedback,

And how do I proceed to exclude them, on my Forcepoint Security manager there are already excluded .exe, I can't find any doc that would talk about files or extensions that could be excluded.

Re: Excluding VPN Client from Forcepoint cloud proxy

PhoneBoy — Thu, 28 Sep 2023 18:12:13 GMT

As there are network drivers involved, this is likely not a simple matter of excluding specific EXEs.
This is probably going to require working with both Check Point and Forcepoint support.
You can open a ticket with the Check Point TAC here (if you have a valid support agreement): https://help.checkpoint.com