Excluding VPN Client from Forcepoint cloud proxy

[Spectrumtech_MS]

Hello all,

We have recently deployed forcepoint cloud proxy agents on our PC fleet.

It seems that the proxy agent intercepts Checkpoint VPN clients and preventing it from establishing a remote access tunnel (IPSEC),

Does anyone have a list of the VPN executable that need to be excluded fro the proxy policy ? Or prhaps a solution to allow VPN client to connect via the Forcepoint proxy ?

Thanks in advance !

[Maarten_Sjouw · Accepted solution]

Exclude the https://<IP of Gateway> in the proxy should do the trick.

[Spectrumtech_MS]

Tx

tried that but it doesn’t seem to work ..

[Spectrumtech_MS]

So it turns out that excluding the VPN gateway's IP address, as suggested by Maaten, rather than its DNS name (as we were using) did the trick !

Thank you !

[pbedel]

This didn't solve the problem, I did add an exception on the forcepoint FSM proxy but I still have a block to mount the tunnel from a client workstation.

[PhoneBoy]

It sounds like the Forcepoint client is acting like a VPN client and there is bound to be conflicts when you have two or more VPN clients on the same box.
Our VPN client has executables but I assume most of the transmission is happening at the driver level.

[pbedel]

Thanks for your feedback,

And how do I proceed to exclude them, on my Forcepoint Security manager there are already excluded .exe, I can't find any doc that would talk about files or extensions that could be excluded.

[PhoneBoy]

As there are network drivers involved, this is likely not a simple matter of excluding specific EXEs.
This is probably going to require working with both Check Point and Forcepoint support.
You can open a ticket with the Check Point TAC here (if you have a valid support agreement): https://help.checkpoint.com