selective split tunneling based on destination

[flachance]

R80.30

Split Tunneling is currently disabled.

Is there a way to enable it only for certain destinations? Like when going to youtube or if using Teams?

thanks

[PhoneBoy]

By definition Split Tunneling means "route some traffic across VPN and route everything else to the Internet directly."
Route All Traffic means exactly that with the local subnet as a possible exception to this rule.
What you probably want is a Remote Access domain that contains everything BUT specific web-based applications.
Currently, we don't offer an easy way to create that.

Personally, I'm not a fan of the "Route All Traffic" approach as it doesn't really scale.
You can get visibility and protection for the Endpoint by deploying the appropriate controls.
Better yet: They don't require you to be connected via VPN for them to apply.

[remi0403]

Hi
This was discussed in https://community.checkpoint.com/message/20006-re-exclude-subnet

[PointOfChecking]

That discussion was for a reverse of this question.

I have a similar issue as this.  However, mine is more simpler, we don't need for specific web-based applications, just specific IP addresses.

[PhoneBoy · Accepted solution]

The encryption domain is IP addresses in the end.
Basically you’d be creating an encryption domain for everything except for the IPs in question.
Similar to this (except you’d define the specific IPs to exclude): https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[PointOfChecking]

Thanks for the pointers!  Got it.

[Rene_Moeller1]

Hi,

Unfortunately, the sk167000 described here does not work for Quantum Sparc Gateways. No matter what I configure, an exception group does not work and is ignored. I have not found any limitations. Do you know of any or is there a trick to circumvent this limitation?

Management Version R81.20 JHF Take53
Gateway: 1595W5G R81.10.10 Build 2906

Thank you.

[PhoneBoy]

Likely will need a TAC case to confirm this is a bug or an RFE that should be addressed via your local Check Point office: https://help.checkpoint.com