Remote Access VPN Clients has no Internet Access when routing through the Gateway

[jyrbn]

Hi, 

We are trying to configure Remote Access VPN on a Centrally Managed (Smart-1 Cloud) Spark 1600, when routing all traffic through the security gateway, remote access clients can ping and access Internal Networks but has no Internet access which is need to access our cloud resources. 

We have followed this sk but are still not successful https://support.checkpoint.com/results/sk/sk101239.

Any ideas on what we could check?

[G_W_Albrecht]

Did you configure this also in rule base ?

As written in https://sc1.checkpoint.com/documents/R80.10_andhigher/WebAdminGuides/EN/CP_RemoteAccessVPN_AdminGuid...

Create the access control rule in the Access Control Policy.

VPN routing traffic is handled in the Security Policy Rule Base as a single connection, matched to one rule only.

[jyrbn]

Which part of the documentation you sent are you referring to?

[G_W_Albrecht]

See the included link !

Hub Mode for Remote Access Clients

[jyrbn]

Yup, we've already enabled hub mode for the clients. 

Whenever I enable VPN tunneling (Routing traffic through the gateway) on the client even my own internet connection becomes "No Internet Access". 

[G_W_Albrecht]

No, i am talking about the rule base - RA clients are restricted by the rule base that tells which networks they can access.

[jyrbn]

Ah yes, we have also configured a rule for remote access clients. 

It's destination is currently set to ANY for testing purposes. 

[PhoneBoy]

Do you see anything in the logs when the Remote Access client connects and attempts to communicate?

[G_W_Albrecht]

Why would you use hub mode at all ? Seems you usually have your private internet connection, so using endpoint security would be safe in all situations; with hub mode, you have the TP GW only when connected thru RA VPN.

[jyrbn]

Our remote access clients needs to access our cloud resources using the Public IP address of our GW because that IP address is the one authorized to access them. That's why we need to route all traffic of the remote clients thru our GW.