Geo Protection-Exception for Remote VPN Users

[Saranya_0305]

Dear Mates,

We are currently operating a Check Point environment with the Management Server and Firewalls running on R82. These firewalls are connected directly to the ISP.

At present, we have implemented Geo-Blocking for all countries except India.

We now have a requirement where remote access VPN users (employees traveling internationally for business) must be allowed connectivity, regardless of the country they are connecting from, while maintaining the existing Geo-Block policy.

Could you please advise if there is a recommended configuration approach, or relevant Check Point community/documentation post that addresses this requirement?

Thanks,

Saranya

[simonemantovani]

Hello

just a question, do you have disabled the option "Accept Remote Access control connections" in the the Global Properties under Firewall section?

To apply Geo proteciont to Remote Access VPN, I think you should uncheck the option above and then configure the policy to permit/block VPN protocols based on geo location. (I never test this solution).

The ports required for VPN are reported in this SK: sk52421.

[PhoneBoy]

VPN traffic (including Remote Access) should be permitted through Implied Rules already.
Which means you should not need to take an action to meet this requirement.

[the_rock]

I agree with @PhoneBoy . If you want to do it another way, check out my post from while ago.

https://community.checkpoint.com/t5/SASE-and-Remote-Access/Geo-VPN-blocking/m-p/214040#M10593

[simonemantovani]

Interesting approach, so you control and appy geo policy only on the port 443 (first port used by the client with visitor mode enabled).

Ok, clear.

[the_rock]

That is 100% right, because thats the port needed for remote access.