topic Checkpoint Endpoint and PAC file for Cloud Proxy in SASE and Remote Access

Checkpoint Endpoint and PAC file for Cloud Proxy

superd — Sat, 07 May 2022 11:13:08 GMT

Hi,

We are currently using Checkpoint Endpoint VPN client for remote access. Without split tunnelling - all traffic to GW.

We are now looking to implement a cloud proxy service by means of a PAC file.

With proxy PAC specified in client browser, we cant get it working with or without VPN conncted.

We essentially want to have PAC browsing available regardless of VPN connectivity.

Is this likely a matter of updating the client desktop policy, or are there some guidlines or settings I may have missed for this type of scenario?

Thanks.

Dave

Re: Checkpoint Endpoint and PAC file for Cloud Proxy

G_W_Albrecht — Sat, 07 May 2022 14:42:36 GMT

See Configuring Remote Clients to Work with Proxy Servers - Remote Access VPN R81.10 Administration Guide p. 200f

Re: Checkpoint Endpoint and PAC file for Cloud Proxy

superd — Sat, 07 May 2022 15:45:33 GMT

Great will do, thanks. Ill let you guys know how it goes.

Re: Checkpoint Endpoint and PAC file for Cloud Proxy

superd — Tue, 10 May 2022 11:25:04 GMT

Hi,

So, Ive reviewed the documentation around proxy servers, and enabled "Detect From IE" on client.

I have split tunnelling enabled, or send all traffic to GW set to "NO".

The ENC domain for the GW object looks ok, in that its only internall addresses / networks.

However, when I launch a browser tab, which should launch the PAC file connection, I see it being forced into the client VPN, and being dropped by the GW.

It seems the routing / VPN config is wrong here.

What would be the most likely issue here, or place to start investigating?

Am I correct to assume the desktop policy doesnt even come into play here, give the traffic is routing over the VPN?

Re: Checkpoint Endpoint and PAC file for Cloud Proxy

G_W_Albrecht — Tue, 10 May 2022 11:55:05 GMT

Contact TAC and get it resolved in a quick RAS.

Re: Checkpoint Endpoint and PAC file for Cloud Proxy

superd — Wed, 11 May 2022 08:23:24 GMT

Schoolboy error - encryption domain misconfigured!!