Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
zsszlama
Explorer

Split tunnel for User/Usergroup

Jump to solution

Hello,

We have a request from our customer to implement split tunnel solution for certain user/users. Currently they have full tunnel remote access VPN.

I've found sk167000 (https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...) tested it also in lab environment and it works great. But it's only applicable for a VPN community.

Is it possible to implement split tunneling somehow for a user group?

Thanks in advance!

Zsolt

0 Kudos
1 Solution

Accepted Solutions
JanVC
Collaborator

in the global properties you set the "route all traffic to gateway" to "configured on endpoint client" for oth the secureclient mobile and endpoint connect options

on the gateway object you tick the box for "allow vpn clients to route traffic through this gateway" and you configure the remote access encryption domain for the split vpn users

if the end user connects once to the gateway, the setting to route all traffic to gateway will no longer be greyed out and the user can freely choose between full tunnel or split tunnel

you could create a new vpn package one for full tunnel users and one for split tunnel users and install accordingly, that way you don't have to teach them about the setting

download the tool from sk122574

i believe you need the setting "neo_route_all_traffic_through_gateway"

 

View solution in original post

8 Replies
the_rock
Champion
Champion

I believe below is what you are looking for:

Screenshot_1.png

 

 Andy

0 Kudos
zsszlama
Explorer

I believe this option just defines which with authentication method can user authenticate on the VPN client.

0 Kudos
PhoneBoy
Admin
Admin

Split tunneling is a global setting, unfortunately, so it applies to everyone.

0 Kudos
zsszlama
Explorer

That's what I thought. Thanks, PhoneBoy!

0 Kudos
JanVC
Collaborator

route all traffic to gateway (yes/no/decide on endpoint)

make the default in the trac.default file to route all traffic to gateway, but tell specific users to manually untick the checkbox in their client?

0 Kudos
zsszlama
Explorer

Sounds good. May I ask for an SK or example from where I can learn and test it?

0 Kudos
JanVC
Collaborator

in the global properties you set the "route all traffic to gateway" to "configured on endpoint client" for oth the secureclient mobile and endpoint connect options

on the gateway object you tick the box for "allow vpn clients to route traffic through this gateway" and you configure the remote access encryption domain for the split vpn users

if the end user connects once to the gateway, the setting to route all traffic to gateway will no longer be greyed out and the user can freely choose between full tunnel or split tunnel

you could create a new vpn package one for full tunnel users and one for split tunnel users and install accordingly, that way you don't have to teach them about the setting

download the tool from sk122574

i believe you need the setting "neo_route_all_traffic_through_gateway"

 

zsszlama
Explorer

Thanks Jan!

 

Meanwhile I've found sk114882. Based on that and your help it works for me in lab environment.

In addition to your settings I've modified the ttm files:

In the test group file:

:neo_route_all_traffic_through_gateway (

:gateway (endpoint_vpn_route_all_traffic_through_gateway

:default (client_decide)

)

 

In the trac_client_1 file:

:neo_route_all_traffic_through_gateway (

:gateway (endpoint_vpn_route_all_traffic_through_gateway

:valid (false)

:default (true)

)

0 Kudos