topic Re: How to exclude a network or host form split tunnel in SASE and Remote Access

How to exclude a network or host form split tunnel

RemoteUser — Tue, 13 Jan 2026 12:10:20 GMT

Hi Mates!!

Can anyone help me to understand, How I can exclude a network from Check Point split tunneling?

Re: How to exclude a network or host form split tunnel

the_rock — Tue, 13 Jan 2026 12:57:12 GMT

Hey bro,

See if below helps.

https://community.checkpoint.com/t5/Remote-Access-VPN/Domain-objects-in-remote-access-vpn-domain/m-p/246249#M12365

Re: How to exclude a network or host form split tunnel

RemoteUser — Tue, 13 Jan 2026 13:04:16 GMT

based on the documentation:
Note: Starting R81.20 Jumbo Hotfix Accumulator Take 122 you can add host/network/range objects for split tunnel on exclusion/inclusion modes.

i can exclude network only from 122? right?

Re: How to exclude a network or host form split tunnel

the_rock — Tue, 13 Jan 2026 13:05:51 GMT

I am fairly sure I had done that for a client thats on way lower jumbo on R81.20

Re: How to exclude a network or host form split tunnel

RemoteUser — Tue, 13 Jan 2026 13:09:15 GMT

Idk brother..

Important:

Naming is critical – the system uses this prefix to identify the mode.
The group must directly contain only these object types:
- Updatable objects
- Dynamic objects
- Domain objects
Nested groups are not supported, even if the nested group contains only allowed object types.

Note: Starting R81.20 Jumbo Hotfix Accumulator Take 122 you can add host/network/range objects for split tunnel on exclusion/inclusion modes.

Re: How to exclude a network or host form split tunnel

the_rock — Tue, 13 Jan 2026 13:10:20 GMT

Thats right...IT HAS TO START with exclusions_

Re: How to exclude a network or host form split tunnel

RemoteUser — Tue, 13 Jan 2026 13:12:14 GMT

yeah i know about that but i asking if it start from 122, but if you told me that you've alreday do that in lower version i trust you

Re: How to exclude a network or host form split tunnel

the_rock — Tue, 13 Jan 2026 13:19:00 GMT

I just checked my notes and I see my colleague and I did this for a client on R81.20 jumbo 99

Re: How to exclude a network or host form split tunnel

RemoteUser — Tue, 13 Jan 2026 13:20:40 GMT

thank you brother i'll try

Re: How to exclude a network or host form split tunnel

the_rock — Tue, 13 Jan 2026 13:21:25 GMT

Sure! Let us know how it goes.

Re: How to exclude a network or host form split tunnel

CP_Chris — Thu, 16 Apr 2026 16:37:39 GMT

Late to the party, but take 122 is where we added the ability to do inclusions for dynamic objects. Prior to this only exclusions were allowed. The difference is when using hub mode, you want to exclude dynamic objects to allow them to go direct to the Internet versus when already using split tunnel (only sending encryption domain across tunnel) but want to add dynamic sites that need to be routed through the RA VPN.

The include is probably most useful when third-party vendors whitelist the IP that is allowed to access a resource. This allows you to force their domain down the RA VPN so the RA users end up using your external (whitelisted) IP.