How to exclude a network or host form split tunnel

[RemoteUser]

Hi Mates!!

Can anyone help me to understand, How I can exclude a network from Check Point split tunneling?

[the_rock]

Hey bro,

See if below helps.

https://community.checkpoint.com/t5/Remote-Access-VPN/Domain-objects-in-remote-access-vpn-domain/m-p...

[RemoteUser]

based on the documentation:
Note: Starting R81.20 Jumbo Hotfix Accumulator Take 122 you can add host/network/range objects for split tunnel on exclusion/inclusion modes.

i can exclude network only from 122? right?

[the_rock]

I am fairly sure I had done that for a client thats on way lower jumbo on R81.20

[RemoteUser]

Idk brother..

Important:

• Naming is critical – the system uses this prefix to identify the mode.

• The group must directly contain only these object types:

  • Updatable objects

  • Dynamic objects

  • Domain objects

  Nested groups are not supported, even if the nested group contains only allowed object types.

  Note: Starting R81.20 Jumbo Hotfix Accumulator Take 122 you can add host/network/range objects for split tunnel on exclusion/inclusion modes.

[the_rock]

Thats right...IT HAS TO START with exclusions_

[RemoteUser]

yeah i know about that but i asking if it start from 122, but if you told me that you've alreday do that in lower version i trust you

[the_rock]

I just checked my notes and I see my colleague and I did this for a client on R81.20 jumbo 99

[RemoteUser]

thank you brother i'll try 

[the_rock]

Sure! Let us know how it goes.

[CP_Chris]

Late to the party, but take 122 is where we added the ability to do inclusions for dynamic objects. Prior to this only exclusions were allowed. The difference is when using hub mode, you want to exclude dynamic objects to allow them to go direct to the Internet versus when already using split tunnel (only sending encryption domain across tunnel) but want to add dynamic sites that need to be routed through the RA VPN.

The include is probably most useful when third-party vendors whitelist the IP that is allowed to access a resource. This allows you to force their domain down the RA VPN so the RA users end up using your external (whitelisted) IP.