Check Point Mobile - missing entries in routing table

[KamilWolan]

Hi,

I spotted strange issue that we have in our environment (R81.10, JHF 139), however I'm not able to find the solution/explanation.
Here is the outcome of the routing table when I'm connected to our VPN with Check Point Mobile:

Here is the same, but for Check Point SSL connection over the browser:

As you can see, for the Check Point Mobile connection, IP 10.2.0.5 is missing, and whole 10.2.0.0/16 network is split into segments. Additionally IPs of all Firewalls Clusters with Mobile blade active is missing (IPs of cluster members are fine).
Do you have any idea what is the reason for this behavior? 

Best regards,
Kamil

[the_rock]

Hey Kamil,

I remember similar issue with customer few years ago and if I recall right, it had to do with the rules configured. I will see if I can find notes about it.

Andy

[the_rock]

For the context, there should be an entry in the routing table for subnet like below (depending what your OM mode subnet is)

What I blur out is DG for it, which should be UPSTREAM router IP

Andy

 

[KamilWolan]

Thanks, I will check it.

[the_rock]

100% you should check it mate AND also, make sure NAT is enabled on it in smart console, as per below.

Andy

 

[PhoneBoy]

Please check the end user's IP address without VPN.
If their local IP is in the encryption domain, you'll see routes like that.
It's expected behavior.

[KamilWolan · Accepted solution]

We find a solution during call with CP support. Policy source for one of FW was set to "Legacy Policy". Somehow it was impacting other FWs with VPN blade (probably because of the same encryption domain used for all VPN entry points).

Anyhow - problem for my case can be solved by changing Policy Source to Unified, or by using different encryption domain for firewall with Legacy Policy Source.   

[the_rock]

Good to know!