topic Re: Harmony Connect Branch route exclusions in SASE and Remote Access

Harmony Connect Branch route exclusions

Ray_Burquest — Thu, 23 Mar 2023 01:30:49 GMT

Excluded routes can be set for the device agent in Harmony Connect to cover internal subnets so they do not route to the Harmony Gateways, Check Point also adds exclusions for a list of destinations (see SK170299) for the likes of YouTube which also go direct and not to Harmony Gateways.

To replicate this routing functionality for a branch (where I may have guest users or we elect to turn off the client) I can add other, more specific IPSec routes on the branch device for the known internal subnets, but how are the Check Point exclusions (like YouTube) catered for? The traffic would route up to the Harmony Gateways as they follow the default gateway.

Ray

Re: Harmony Connect Branch route exclusions

PhoneBoy — Thu, 23 Mar 2023 14:17:19 GMT

I believe we can only manage the application specific exclusions on the client itself.
For branch office devices, it would have to be configured on the device itself (subject to what it allows).

Re: Harmony Connect Branch route exclusions

Ray_Burquest — Thu, 23 Mar 2023 21:15:58 GMT

Thanks, that makes sense when I configure the routing set up of the SDWAN device. I think the SK should be updated to add a note about this and to alert people to the risk of some apps not working as alluded to in the SK.

Re: Harmony Connect Branch route exclusions

PhoneBoy — Thu, 23 Mar 2023 22:04:09 GMT

Sounds like a good suggestion.
Recommend leaving specific feedback on the SK.