Create a Post
Showing results for 
Search instead for 
Did you mean: 

Understand Mobile access routing/split-tunelling and native applications

Hi all,


I'm struggling to understand how checkpoint Mobile Access handles routing and split-tunnel on remote clients.

I have Mobile Access with office mode. Doing some test I get this following logic. I will use an example tu explain the concept.


Let's assume this scenario:

I have 2 Remote users Mario and Luigi.

We have 2 native applications: Server A and Server B.

Mario has a rule that allows to reach Server A.

Luigi has a rule that allows to reach Server B.

If we give a look at Mario's (or Luigi is the same) routing table once connected to VPN, he has both routes to Server A and B pointing to VPN tunnel even if his not authorized to go to Server B.


So default behavior is that everything is declared as Native Application will be pushed as a route to Remote Clients. It's correct?

I could accept this logic but I'm facing a funny issue. On a customer I found a similar scenario as described before, but just assume that this time Server B is a public server...let's say

The result is that Mario can go to Server A, but not to even if could use it's own internet connection (split-tunnel).

Luigi instead can go to but using the VPN tunnel through corporate network.


It's all correct or I'm missing some workaround or configuration to allow Mario to route traffic to with out sending it to the VPN tunnel?


Thank you,


0 Kudos
1 Reply

If this is about Mobile Access Portal only, then Google is not an internal Web Application, so the comparison is wrong. Did you consult the Mobile Access R81 Administration Guide already ? If you use other CP RA VPN possibilities beside MAB (Capsule, Mobile, Endpoint Security VPN...) you can route all traffic through the main site to participate from GW TP / TE / TX like when situated in the internal company network.



Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events