topic Re: Restricting Gmail access to custom domain in Spark Firewall (SMB)

Restricting Gmail access to custom domain

arsathparves — Fri, 16 Sep 2022 14:15:24 GMT

Is it possible to block personal email accounts and allow only specific domains for example in my scenario I want to block users access to personal gmail / drive and allow only work email / drive?

#QuantumSpark#1600

Re: Restricting Gmail access to custom domain

PhoneBoy — Fri, 16 Sep 2022 18:06:39 GMT

I have no idea if this feature works on SMB appliances (centrally or locally managed), but the feature is documented here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk146993

Re: Restricting Gmail access to custom domain

the_rock — Sat, 17 Sep 2022 02:24:31 GMT

I believe you can create custom domains and allow/block them that way.

Re: Restricting Gmail access to custom domain

arsathparves — Sat, 17 Sep 2022 12:59:08 GMT

how would you do that ? for example if you take google workspace for example to login into that it you have to navigate to eg:mail.gmail.com if i block this whole domain and allow only "myworkemail.com" I wont be able go to that site to login to my custom domains

Re: Restricting Gmail access to custom domain

the_rock — Sat, 17 Sep 2022 13:02:28 GMT

I would have to show you on remote session. Essentially, you create rule above the blocked rule that would allow users to connect to what you need them to connect to.

Re: Restricting Gmail access to custom domain

arsathparves — Sat, 17 Sep 2022 13:17:33 GMT

Ok thanks I will try this out

Re: Restricting Gmail access to custom domain

PhoneBoy — Sat, 17 Sep 2022 13:17:58 GMT

In this case, you have to inject specific headers into the communication which tells the remote end what accounts are allowed.
It cannot be accomplished by simply filtering for specific domains in an Access Policy.

Re: Restricting Gmail access to custom domain

the_rock — Sun, 18 Sep 2022 14:00:15 GMT

Sorry, Im not sure if it works differently with quantum 1600 (smb) appliances, but Im sure you would know better : - )

Re: Restricting Gmail access to custom domain

PhoneBoy — Mon, 19 Sep 2022 23:40:32 GMT

It has nothing to do with an SMB appliance, it has to do with how the authentication for Google Workspace works.
More precisely, the same URLs are used for Gmail and Google Workspace.
As a result, by blocking the URLs, you're preventing use of ANY Google services, not just Gmail.

By injecting the appropriate HTTP header as described in the SK, you are telling Google that only specific Google Workspace accounts are allowed.
Google ultimately enforces this.

Re: Restricting Gmail access to custom domain

G_W_Albrecht — Tue, 20 Sep 2022 12:09:27 GMT

I have asked that in my feedback to sk146993 8)