Dynamic Split Tunneling for SaaS Using Updatable Objects

1. Connect with SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to the Security Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. / Domain Management Server that manages this Security Gateway / Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing..

2. Configure Remote Access VPN.
   

   See Getting Started with Remote Access.

3. Configure Hub Mode.

   See Hub Mode (VPN Routing for Remote Clients)

4. Configure a dedicated encryption domain for Remote Access VPN.

   See Advanced VPN Domain Configuration

5. From the left navigation panel, click Gateways & Servers.

6. Open the Security Gateway / Cluster object:

   1. In the left navigation tree, click Network Management > VPN Domain.

   2. Select User defined.

   3. In the Encryption Domain field, select the Group object you configured for the Remote Access VPN community.

   4. In this Group object, add a nested Simple Group object with a name that begins with:

      exclusions_

      Important - Dynamic Split Tunneling uses this nested group. Therefore, this Simple Group object can include objects only from these types: Updatable, Dynamic, or Domain.

   5. Add the applicable object for your SaaS to this nested group.

   6. Click OK.

7. In SmartConsole, install the Access Control Policy on the Security Gateway / Cluster object.

To enable the feature on the Remote Access VPN client, do one of these:

• Edit the '$FWDIR/conf/trac_client_1.ttm' file on the Security Gateway

  1. Connect to the command line on the Security Gateway / each Cluster Member Security Gateway that is part of a cluster..

  2. Log in to the Expert mode.

  3. Back up the current $FWDIR/conf/trac_client_1.ttm file:

     cp -v $FWDIR/conf/trac_client_1.ttm{,_BKP}

  4. Edit the current $FWDIR/conf/trac_client_1.ttm file:

     vi $FWDIR/conf/trac_client_1.ttm

  5. In the main parameter "trac_client_1", add the new parameter "split_tunnel" as appears below:

     Copy

     (
         :trac_client_1 (
             :split_tunnel (
                 :gateway (
                     :default (true)
                 )
             )
     
             :<other_parameters> (
             ... ...
             )
         )
     )

  6. Save the changes in the file and exit the editor.

  7. In SmartConsole, install the Access Control policy on the Security Gateway / Cluster Object.

  The feature is available on the VPN client after the administrator makes a new connection between the Security Gateway and a Remote Access VPN tunnel.

• Edit the 'trac.defaults' file on the VPN client (located in the VPN client's installation folder)

  Note - For information on how to prepare an installation package with the VPN Configuration Utility, see sk122574.

  1. Go to the VPN client installation directory:

     Operating System	Default Path
     Windows OS 32-bit	One of these: %ProgramFiles%\CheckPoint\Endpoint Security\Endpoint Connect\ %ProgramFiles%\CheckPoint\Endpoint Connect\
     Windows OS 64-bit	One of these: %ProgramFiles(x86)%\CheckPoint\Endpoint Security\Endpoint Connect\ %ProgramFiles(x86)%\CheckPoint\Endpoint Connect\
     macOS	/Library/Application Support/Checkpoint/Endpoint Security/Endpoint Connect/

  2. Create a copy of the current trac.defaults file.

  3. Edit the current trac.defaults file with an advanced plain-text editor (such as Notepad++, UltraEdit, PSPad).

  4. Configure the value of the "split_tunnel" parameter to "true":

     split_tunnel STRING true GW_USER 0

     Important - Do not change other predefined strings in this line - "STRING", "GW_USER", and "0".

  5. Save your changes and close the file.

  6. Restart the computer with the VPN client installed.

  The VPN client starts to exclude SaaS services the next time it creates a new Remote Access VPN tunnel to the Security Gateway.