topic Re: Split tunnel for User/Usergroup in SASE and Remote Access

Split tunnel for User/Usergroup

zsszlama — Tue, 12 Apr 2022 12:47:17 GMT

Hello,

We have a request from our customer to implement split tunnel solution for certain user/users. Currently they have full tunnel remote access VPN.

I've found sk167000 (https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk167000) tested it also in lab environment and it works great. But it's only applicable for a VPN community.

Is it possible to implement split tunneling somehow for a user group?

Thanks in advance!

Zsolt

Re: Split tunnel for User/Usergroup

the_rock — Tue, 12 Apr 2022 12:58:21 GMT

I believe below is what you are looking for:

Andy

Re: Split tunnel for User/Usergroup

PhoneBoy — Tue, 12 Apr 2022 13:53:27 GMT

Split tunneling is a global setting, unfortunately, so it applies to everyone.

Re: Split tunnel for User/Usergroup

zsszlama — Wed, 13 Apr 2022 07:09:44 GMT

I believe this option just defines which with authentication method can user authenticate on the VPN client.

Re: Split tunnel for User/Usergroup

zsszlama — Wed, 13 Apr 2022 07:10:49 GMT

That's what I thought. Thanks, PhoneBoy!

Re: Split tunnel for User/Usergroup

JanVC — Wed, 13 Apr 2022 09:58:36 GMT

route all traffic to gateway (yes/no/decide on endpoint)

make the default in the trac.default file to route all traffic to gateway, but tell specific users to manually untick the checkbox in their client?

Re: Split tunnel for User/Usergroup

zsszlama — Wed, 13 Apr 2022 12:22:18 GMT

Sounds good. May I ask for an SK or example from where I can learn and test it?

Re: Split tunnel for User/Usergroup

JanVC — Thu, 14 Apr 2022 06:32:35 GMT

in the global properties you set the "route all traffic to gateway" to "configured on endpoint client" for oth the secureclient mobile and endpoint connect options

on the gateway object you tick the box for "allow vpn clients to route traffic through this gateway" and you configure the remote access encryption domain for the split vpn users

if the end user connects once to the gateway, the setting to route all traffic to gateway will no longer be greyed out and the user can freely choose between full tunnel or split tunnel

you could create a new vpn package one for full tunnel users and one for split tunnel users and install accordingly, that way you don't have to teach them about the setting

download the tool from sk122574

i believe you need the setting "neo_route_all_traffic_through_gateway"

Re: Split tunnel for User/Usergroup

zsszlama — Thu, 14 Apr 2022 13:48:50 GMT

Thanks Jan!

Meanwhile I've found sk114882. Based on that and your help it works for me in lab environment.

In addition to your settings I've modified the ttm files:

In the test group file:

:neo_route_all_traffic_through_gateway (

:gateway (endpoint_vpn_route_all_traffic_through_gateway

:default (client_decide)

)

In the trac_client_1 file:

:neo_route_all_traffic_through_gateway (

:gateway (endpoint_vpn_route_all_traffic_through_gateway

:valid (false)

:default (true)

)