topic Re: Check Point Mobile - missing entries in routing table in SASE and Remote Access

Check Point Mobile - missing entries in routing table

KamilWolan — Thu, 13 Jun 2024 10:46:26 GMT

Hi,

I spotted strange issue that we have in our environment (R81.10, JHF 139), however I'm not able to find the solution/explanation.
Here is the outcome of the routing table when I'm connected to our VPN with Check Point Mobile:

Here is the same, but for Check Point SSL connection over the browser:

As you can see, for the Check Point Mobile connection, IP 10.2.0.5 is missing, and whole 10.2.0.0/16 network is split into segments. Additionally IPs of all Firewalls Clusters with Mobile blade active is missing (IPs of cluster members are fine).
Do you have any idea what is the reason for this behavior?

Best regards,
Kamil

Re: Check Point Mobile - missing entries in routing table

the_rock — Thu, 13 Jun 2024 12:07:14 GMT

Hey Kamil,

I remember similar issue with customer few years ago and if I recall right, it had to do with the rules configured. I will see if I can find notes about it.

Andy

Re: Check Point Mobile - missing entries in routing table

the_rock — Thu, 13 Jun 2024 12:40:52 GMT

For the context, there should be an entry in the routing table for subnet like below (depending what your OM mode subnet is)

What I blur out is DG for it, which should be UPSTREAM router IP

Andy

Re: Check Point Mobile - missing entries in routing table

KamilWolan — Thu, 13 Jun 2024 12:52:24 GMT

Thanks, I will check it.

Re: Check Point Mobile - missing entries in routing table

the_rock — Thu, 13 Jun 2024 12:54:50 GMT

100% you should check it mate AND also, make sure NAT is enabled on it in smart console, as per below.

Andy

Re: Check Point Mobile - missing entries in routing table

PhoneBoy — Fri, 14 Jun 2024 21:36:12 GMT

Please check the end user's IP address without VPN.
If their local IP is in the encryption domain, you'll see routes like that.
It's expected behavior.

Re: Check Point Mobile - missing entries in routing table

KamilWolan — Mon, 17 Jun 2024 08:52:58 GMT

We find a solution during call with CP support. Policy source for one of FW was set to "Legacy Policy". Somehow it was impacting other FWs with VPN blade (probably because of the same encryption domain used for all VPN entry points).

Anyhow - problem for my case can be solved by changing Policy Source to Unified, or by using different encryption domain for firewall with Legacy Policy Source.

Re: Check Point Mobile - missing entries in routing table

the_rock — Mon, 17 Jun 2024 10:21:21 GMT

Good to know!