topic How to restrict a remote access user to only allowed to access to one subnet in Spark Firewall (SMB)

How to restrict a remote access user to only allowed to access to one subnet

ken2 — Mon, 04 Jul 2022 06:08:53 GMT

Hi folks,

How to restrict a remote access user to only allowed to access to one subnet on spark 1600? Let say I have created a user call "UserA" and grant the remote access permission for that user. From Access Policy > Firewall Access Blade policy is Standard. No user awareness enabled. From Access Policy > Firewall Policy > Incoming, Internal and VPN traffic, I have a rule to allow UserA (source) to access to 192.168.10.0 (destination) for any service.

But once UserA remotes access to the office, UserA can access any internal subnet but is not restricted to only access 192.168.10.0. Is there anything I have set the CheckPoint device wrongly?

Thanks

Ken

Re: How to restrict a remote access user to only allowed to access to one subnet

_Val_ — Mon, 04 Jul 2022 07:50:04 GMT

Please add screenshots here

Re: How to restrict a remote access user to only allowed to access to one subnet

G_W_Albrecht — Mon, 04 Jul 2022 08:02:29 GMT

When enabling RA VPN, you check "allow traffic from Remote Access users" and a buildt-in rule is enabled. Disable it and your rule will work.

Re: How to restrict a remote access user to only allowed to access to one subnet

ken2 — Mon, 04 Jul 2022 08:26:21 GMT

Here are the screenshots...

UserA has remote access granted

From the Incoming, Internal and VPN traffic, I have created Onlyto Network object group in which only contain the 192.168.10.0 subnet.

There is another auto Generated rules referring to VPN Remote Access in which I do not have a clue of what it is.

Thanks _Val_

Re: How to restrict a remote access user to only allowed to access to one subnet

ken2 — Mon, 04 Jul 2022 08:29:46 GMT

Hi, thanks for you reply, too. Do you mean to uncheck the Allow traffic from Remote Access users checkbox in order to get the rule valid? If I uncheck the box, can UserA still be able to do remote access from the outside world?

Re: How to restrict a remote access user to only allowed to access to one subnet

G_W_Albrecht — Mon, 04 Jul 2022 08:33:51 GMT

If there is a manual rule granting access to UserA he will - the other 14 users have no access then without new rules...