topic Re: SASE determine user location in SASE and Remote Access

SASE determine user location

jamesdean-1 — Wed, 11 Jun 2025 02:13:50 GMT

Hi guys, this is a 101 question - how does SASE determine of the user is in the office or elsewhere?

We are having repeated issues of users getting a message "no internet connection" whilst in the office, the wireless logs say they are still connected, I suspect SASE is failing the in the office test maybe due to latency/loss or wifi roaming, then connecting itself, which is not going to work in the office and break their Internet.

Is there any way I can confirm this? I presume it tries to access the local DNS server. When the users are in the office I see constant attempts to an unknown DNS server which is blocked, is the check a reverse check perhaps, ie if I can see this Ip then they are not in the office?

Re: SASE determine user location

the_rock — Wed, 11 Jun 2025 02:31:37 GMT

I can check in our lab tomorrow, but Im fairly sure it goes with combination of posture check/ZTNA and there is also setting on the agent for wi-fi, but cant recall exactly what...will check on the agent. It might be also related to geolocation setting as well.

Andy

Re: SASE determine user location

jamesdean-1 — Wed, 11 Jun 2025 02:58:25 GMT

Appreciated thanks!

Re: SASE determine user location

the_rock — Wed, 11 Jun 2025 03:10:58 GMT

Of course!

Re: SASE determine user location

the_rock — Wed, 11 Jun 2025 15:03:47 GMT

How is attached set up?

Andy

Re: SASE determine user location

PhoneBoy — Wed, 11 Jun 2025 19:44:46 GMT

That's the end user side.
The Infinity Portal side is where you can configure when the "Always-on VPN" terminates because it is in a trusted environment.
It is looking for (and you can configure):

A trusted web server only accessible when on-premise (specify the CA of this server)
Router MAC address

Re: SASE determine user location

the_rock — Wed, 11 Jun 2025 19:50:38 GMT

Ah, since I dont have access to that, I was trying to find it on perimeter81.com site portal, but dont see where : - (

Andy

Re: SASE determine user location

the_rock — Wed, 11 Jun 2025 21:19:27 GMT

Nm, got it. Went to chat and guy was super helpful, told me right away 🙂

Under users -> user profiles

Andy

Re: SASE determine user location

jamesdean-1 — Fri, 13 Jun 2025 00:07:03 GMT

that's great thank you both,

Confirmed we have trusted environment enable and the router mac address is correctly specified.

Re: SASE determine user location

the_rock — Fri, 13 Jun 2025 00:15:34 GMT

Sounds like you are all set. If you need anything else tested, let us know. I have access to our company lab environment, but can check any other settings in live client's environment as well.

If it helps, below is some info I gathered from the lab my colleague and I did recently.

https://community.checkpoint.com/t5/SASE/Harmony-SASE-lab-doc/m-p/244114

Andy

Re: SASE determine user location

Gustavo_Ferreir — Fri, 13 Jun 2025 17:56:54 GMT

Here, the option to use the router's MAC address didn't work very well. On the other hand, the Trusted Web Server option is working perfectly. However, I had to open a support ticket, and they sent me a version (11.6) of the agent that isn't available for download on the portal — at least not in my workspace.

Re: SASE determine user location

the_rock — Fri, 13 Jun 2025 18:00:13 GMT

Are you referring to what I attached?

Andy

Re: SASE determine user location

PhoneBoy — Fri, 13 Jun 2025 20:27:24 GMT

I believe the Router MAC can only be detected if it's on the same L2 network as the end user.
A Trusted Web Server seems more likely to work in more situations.