topic VPN Client to Client Connections without hub mode in SASE and Remote Access

VPN Client to Client Connections without hub mode

Reyman2021 — Sat, 10 Oct 2020 13:06:05 GMT

Is there a way we can achieve remote access vpn client to client connection without using hub mode? We still want to use the default configuration which is split tunneling as the hub mode consumed the head office bandwidth.

Re: VPN Client to Client Connections without hub mode

PhoneBoy — Sat, 10 Oct 2020 15:13:50 GMT

See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113474

Re: VPN Client to Client Connections without hub mode

Reyman2021 — Sun, 11 Oct 2020 03:43:58 GMT

Hi, This is a hub mode setup. Is it possible without enabling the hub mode?

Re: VPN Client to Client Connections without hub mode

PhoneBoy — Sun, 11 Oct 2020 06:07:10 GMT

The setting in that SK is to allow it when required, not force it.
The "force" setting is in Global Properties and it should not be required in this case:

Re: VPN Client to Client Connections without hub mode

Reyman2021 — Sun, 11 Oct 2020 12:08:32 GMT

Hi,

I think this is the same in per gateway object. The only difference is in global properties, it is enabled to all gateways managed by the management server? Am I correct?

Re: VPN Client to Client Connections without hub mode

PhoneBoy — Sun, 11 Oct 2020 16:05:15 GMT

The global properties setting can require clients to use hub mode, the gateway setting merely allows such routing to occur when necessary (e.g. when RA clients need to talk to each other).

Re: VPN Client to Client Connections without hub mode

Reyman2021 — Mon, 12 Oct 2020 03:50:44 GMT

Based on sk101239, it looks the same. Do you mean it will now consumed bandwidth and throughput from the gateway if we only enabled it per gateway and not in the global properties?

Re: VPN Client to Client Connections without hub mode

Reyman2021 — Mon, 12 Oct 2020 03:56:34 GMT

Sorry let me rephrase it.

Based on sk101239, it looks the same. Do you mean it will not consumed bandwidth and throughput from the gateway if we only enabled it per gateway and not in the global properties?