Force VPN Checkpoint

[ELKAMO]

Hi,

Is there a way to force users to connect to Checkpoint VPN without using GPO ? That means users can't use Internet unless they are connected to VPN. I have read that many other VPN offer a called VPN Kill switch fonction, does Checkpoint offer a similar one ?

Than you in advance

[AlejandroH]

There is a feature called “always on”. It was discussed on this thread. 

https://community.checkpoint.com/t5/Remote-Access-VPN/Endpoint-VPN-and-auto-connect/td-p/47055

[ELKAMO]

Thank you very much for your response.

[PhoneBoy]

In addition to always on, you will need to configure the firewall policy on the client to block most traffic when disconnected from the VPN.
This requires a full Endpoint license as the Desktop Firewall is only supported with that license.

[Simply_sachin]

Hi Phoneboy,

I would like to try this out. What kind of policy / rule i should push to deny rest of the traffic but uses end point VPN traffic ?

[Simply_sachin]

Hi Phoneboy,

Any advice ?

[PhoneBoy]

Recommend reading the ATRG for Endpoint Firewall: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 

[Agent_Smith]

Is there a way to do this when a user is not VPN block all network access? I was looking and saw that there are inside and outside network options for defining rules. However I'm not sure what defines inside or outside network. If it is just communication with the management station without VPN then this will not accomplish what we want. What is a rule set where we can force VPN, and allow no other traffic unless VPN. I was thinking along the lines of getting an office mode IP then traffic opens, or if the client knows the user isn't VPN then deny all

[Chris_Atkinson]

One option might be to look at the "Disconnected" policy, which is enforced when the client cannot talk to the Endpoint Management.