Understand Mobile access routing/split-tunelling and native applications

[gcarella]

Hi all,

I'm struggling to understand how checkpoint Mobile Access handles routing and split-tunnel on remote clients.

I have Mobile Access with office mode. Doing some test I get this following logic. I will use an example tu explain the concept.

Let's assume this scenario:

I have 2 Remote users Mario and Luigi.

We have 2 native applications: Server A and Server B.

Mario has a rule that allows to reach Server A.

Luigi has a rule that allows to reach Server B.

If we give a look at Mario's (or Luigi is the same) routing table once connected to VPN, he has both routes to Server A and B pointing to VPN tunnel even if his not authorized to go to Server B.

So default behavior is that everything is declared as Native Application will be pushed as a route to Remote Clients. It's correct?

I could accept this logic but I'm facing a funny issue. On a customer I found a similar scenario as described before, but just assume that this time Server B is a public server...let's say google.com.

The result is that Mario can go to Server A, but not to google.com even if could use it's own internet connection (split-tunnel).

Luigi instead can go to google.com but using the VPN tunnel through corporate network.

It's all correct or I'm missing some workaround or configuration to allow Mario to route traffic to goolge.com with out sending it to the VPN tunnel?

Thank you,

Gianluigi

[G_W_Albrecht]

If this is about Mobile Access Portal only, then Google is not an internal Web Application, so the comparison is wrong. Did you consult the Mobile Access R81 Administration Guide already ? If you use other CP RA VPN possibilities beside MAB (Capsule, Mobile, Endpoint Security VPN...) you can route all traffic through the main site to participate from GW TP / TE / TX like when situated in the internal company network.