Different Routes for Remote VPN clients

[Glenmark_Impex]

Hi everyone,

We have task to propagate different routes for Remote VPN clients. Is it possible?

Environment:

Checkpoint FW - R81.10 Jumbo Hotfix Take 181

Remote access VPN clients Checkpoint Mobile VPN E88.10 with LDAP Authentication.

Remote clients receive from Checkpoint GW  Office mode manually defined ip addresses.

Scenario:

Only specific Remote VPN client should be able to reach not only local subnets but also some specific subnets which located behind s-2-s VPN tunnel in different location.

Traffic flow diagram for specific Remote VPN clients.

Remote Client <-> Checkpoint GW (local int) <-> (local int) VPN GW <-> VPN GW <-> dst subnets.

[PhoneBoy]

Yes, you will need to add the relevant subnets to the RemoteAccess Encryption Domain.
Whether the client has access to these subnets is a function of the defined Access Policy, but all clients will receive the routes.

[Glenmark_Impex]

Dear PhoneBoy.

Thank you for reply but we need add subnets ONLY for specific Remote VPN clients (AD accounts). 

May be it will be possible via some "routing tables" config file on client side or something similar with TRAC file on FW side?

[AkosBakos]

Hi @Glenmark_Impex 

I'm not 100% sure this will be a solution, but I would like to share with you. 

As I see you are using a VPN pool for the RA cliens IP-s.

First, consider to use ipassingment.conf ( $FWDIR/conf/ipassignment.conf), define a smaller network from the VPN pool for a specific AD group.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/C...

This allows you to handle the client separetly in the rulebase. "A" group reaches the internet, and the "B" not.

I hope it helps,

Akos

[PhoneBoy]

@Glenmark_Impex is explicitly asking about the routes received on the client.
Unfortunately, this is not customizable on a per-user/group basis.

[Glenmark_Impex]

Hi AkosBakos

Sorry but no, only specific clients "should know" about destination subnets.... Also we are considering the possibility to use MEP or just run another one Checkpoint with Remote VPN blade