Split Tunnel Domain group

cdooer · ‎2025-03-04

Hey folks. Wondering if anyone has gotten this working yet, and are using it in a production environment? I've tried following the instructions laid out in this document; https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_RemoteAccessVPN_AdminGuide/Content... , but when I attempt to add the domain group to the VPN group, I get

I've got a call open with TAC, thought I'd post it here as well just in case anyone had any ideas while TAC gets around to looking at it. Running R81.20.

the_rock · ‎2025-03-11

I think so.

cdooer · ‎2025-03-11

Wonder if I can find a guide somewhere that would walk me through converting from whatever mode I'm in now, over to Hub Mode? Maybe that's a question for TAC...

the_rock · ‎2025-03-11

Dont believe there is an official guide per se, but I would check out below.

Andy

https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN...

PhoneBoy · ‎2025-03-06

Dynamic Split Tunneling requires using Hub Mode, which will break your existing Split Tunneling configuration.

cdooer · ‎2025-03-10

Hmm, ok. A couple of follow up questions...

1 - Is Hub Mode gateway specific, meaning I can test it easily against a single VPN cluster, or does it affect the entire Remote Access Community?

2 - Is it possible to split tunnel domains, AND IP addresses in the same configuration?

cdooer · ‎2025-03-24

TAC got back to me on Friday, and they say that Hub Mode isn't required for this to work, the problem seems to be the Group With Exclusions, rather than it being just a simple group. I've got another call with them later today, but I'm wondering if I could just add my normal IP exclusions to this new exclusions_ group, along with my domain objects? I tried it in my lab, and it didn't give me any validation errors, but I don't have any way to actually test the VPN connectivity in my lab in order to see what it shows in the clients routing table.

Jan_Kleinhans

Hi,

did you found a way to migrate from "old" split tunneling to dynamic split tunneling?

At the moment our VPN Domain is a group with exclusions (any - special internet adresses like o365 which I generate via a script)

Now I want to go the new way. Do I have to create a Simple group with all "local networks + Internet" and add the exclusions_xxx group to this? And do I also have to edit trac_conf.ttm?

Regards,

Jan

PhoneBoy

That sounds correct, yes.

Are you a member of CheckMates?