topic Re: Split tunnel and exclude subnets in SASE and Remote Access

Split tunnel and exclude subnets

Air — Sun, 21 Jul 2024 14:23:29 GMT

Hi Team.

I have one SMS and two RA GW. The first RA GW configured that send into vpn tunnel only needed subnets other traffic send to local ISP. The second GW configured that send all traffic into vpn tunnel and exclude some subnets to local ISP.

But now I have problem when user connect to the first GW, they received route that configured on the second GW. But on the 1st GW configure correct VPN Domain and user must receive route to vpn tunnel for some subnets.

Re: Split tunnel and exclude subnets

PhoneBoy — Sun, 21 Jul 2024 15:39:30 GMT

By design, when you “add new site” you get information about all VPN gateways managed by the same SMS.
Version/JHF level along with a diagram of what you’re trying to achieve will help tremendously.

Re: Split tunnel and exclude subnets

Air — Sun, 21 Jul 2024 17:53:44 GMT

Version: R81.10 Take 150.

I installed two different RA GW, disable MEP.

And I want when users connect to first RA GW only office subnets route to vpn tunnel and other traffic through local ISP.

And when user connect to second RA GW all traffic route to vpn.

Now when user connect to first RA VPN that all traffic route to vpn and ignore VPN Domains for this GW.

I configured different VPN Domains.

Subnets that need route on first and second RA GW overlaps, because second RA GW route all traffic to vpn.

Is it possible using one SMS have two different rule for RA VPN?

Re: Split tunnel and exclude subnets

the_rock — Sun, 21 Jul 2024 17:55:49 GMT

I think if you read below link ,it will clear certain things up. Specially section that talkes about IMPLICIT mep...

Andy

https://sc1.checkpoint.com/documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_RemoteAccessVPN_AdminGuide/html_frameset.htm?topic=documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_RemoteAccessVPN_AdminGuide/164758

Re: Split tunnel and exclude subnets

Air — Sun, 21 Jul 2024 18:00:34 GMT

I read this. MEP is disabled.

Re: Split tunnel and exclude subnets

the_rock — Sun, 21 Jul 2024 18:06:13 GMT

So please answer this question...how are enc domains configured? Is it overlapping or they have seperate subnets/groups? This info is IMPORTANT.

Andy

Re: Split tunnel and exclude subnets

Air — Sun, 21 Jul 2024 18:16:22 GMT

VPN-SINet-Subnets has list of subnets

ED-remoteaccess has All-Internet-group

Re: Split tunnel and exclude subnets

the_rock — Sun, 21 Jul 2024 18:35:27 GMT

In such case, document says to follow ttm file to be manual, ie domains are NOT overlapping, which they are not in your case. I had done this for customers before and we followed exactly what it shows in the link I sent you, no issues.

Andy

Re: Split tunnel and exclude subnets

Air — Mon, 22 Jul 2024 02:42:08 GMT

I am not sure that understood.

Now I have config ttm file:

automatic_mep_topology - false

mep_mode - dns_based

enable_gw_resolving - true

And nothing worked

Re: Split tunnel and exclude subnets

the_rock — Mon, 22 Jul 2024 03:04:31 GMT

I will check in the morning, as I have this working in the lab. Make sure to follow al the steps from that document, it works 100%.

Andy

Re: Split tunnel and exclude subnets

PhoneBoy — Mon, 22 Jul 2024 12:55:00 GMT

There's an SK that covers this specific scenario: https://support.checkpoint.com/results/sk/sk111995

Re: Split tunnel and exclude subnets

the_rock — Mon, 22 Jul 2024 12:58:57 GMT

Interesting...never recall having to follow this sk before.

Andy

Re: Split tunnel and exclude subnets

Air — Thu, 01 Aug 2024 14:52:29 GMT

Problem was decided when remove MEP in the file trac.defaults . Disable MEP from GW side did not work

Re: Split tunnel and exclude subnets

the_rock — Thu, 01 Aug 2024 14:54:21 GMT

Thats what document was indicating as well.

Re: Split tunnel and exclude subnets

Air — Thu, 01 Aug 2024 14:57:12 GMT

In the document indicated on GW side (need edit file on GW), I removed on client side (edit client file).

Re: Split tunnel and exclude subnets

the_rock — Thu, 01 Aug 2024 14:58:27 GMT

Never had to do that myself...what are versions of the gw/client?

Andy

Re: Split tunnel and exclude subnets

Air — Thu, 01 Aug 2024 15:00:59 GMT

GW - R81.10 Take 150, Client 88.30 and 86.50

Re: Split tunnel and exclude subnets

the_rock — Thu, 01 Aug 2024 15:04:47 GMT

Done it with those versions, NEVER have I had to modify anything on the client side.