topic Re: Different Routes for Remote VPN clients in SASE and Remote Access

Different Routes for Remote VPN clients

Glenmark_Impex — Tue, 28 Oct 2025 12:35:16 GMT

Hi everyone,

We have task to propagate different routes for Remote VPN clients. Is it possible?

Environment:

Checkpoint FW - R81.10 Jumbo Hotfix Take 181

Remote access VPN clients Checkpoint Mobile VPN E88.10 with LDAP Authentication.

Remote clients receive from Checkpoint GW Office mode manually defined ip addresses.

Scenario:

Only specific Remote VPN client should be able to reach not only local subnets but also some specific subnets which located behind s-2-s VPN tunnel in different location.

Traffic flow diagram for specific Remote VPN clients.

Remote Client <-> Checkpoint GW (local int) <-> (local int) VPN GW <-> VPN GW <-> dst subnets.

Re: Different Routes for Remote VPN clients

PhoneBoy — Tue, 28 Oct 2025 14:20:51 GMT

Yes, you will need to add the relevant subnets to the RemoteAccess Encryption Domain.
Whether the client has access to these subnets is a function of the defined Access Policy, but all clients will receive the routes.

Re: Different Routes for Remote VPN clients

Glenmark_Impex — Tue, 28 Oct 2025 15:06:17 GMT

Dear PhoneBoy.

Thank you for reply but we need add subnets ONLY for specific Remote VPN clients (AD accounts).

May be it will be possible via some "routing tables" config file on client side or something similar with TRAC file on FW side?

Re: Different Routes for Remote VPN clients

AkosBakos — Wed, 29 Oct 2025 11:45:50 GMT

Hi @Glenmark_Impex

I'm not 100% sure this will be a solution, but I would like to share with you.

As I see you are using a VPN pool for the RA cliens IP-s.

First, consider to use ipassingment.conf ( $FWDIR/conf/ipassignment.conf), define a smaller network from the VPN pool for a specific AD group.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/Office-Mode.htm

This allows you to handle the client separetly in the rulebase. "A" group reaches the internet, and the "B" not.

I hope it helps,

Akos

Re: Different Routes for Remote VPN clients

PhoneBoy — Wed, 29 Oct 2025 14:42:17 GMT

@Glenmark_Impex is explicitly asking about the routes received on the client.
Unfortunately, this is not customizable on a per-user/group basis.

Re: Different Routes for Remote VPN clients

Glenmark_Impex — Thu, 30 Oct 2025 07:44:32 GMT

Hi AkosBakos

Sorry but no, only specific clients "should know" about destination subnets.... Also we are considering the possibility to use MEP or just run another one Checkpoint with Remote VPN blade