Dynamic Split Tunneling for SaaS Using Updatable Objects

To decrease load on a VPN Gateway, you can exclude traffic for SaaS from your Remote Access VPNClosed An encrypted tunnel between remote access clients (such as Endpoint Security VPN) and a Security Gateway. Tunnel in Hub Mode.

Chain of Events:

  1. Administrator configures which services to exclude from the Remote Access VPN Tunnel.

  2. The VPN Gateway dynamically fetches the IP addresses of configured services from the Internet, and sends this information to Remote Access VPN clients.

  3. Remote Access VPN clients exclude traffic for these services from the Remote Access VPN Tunnel.

Prerequisites

This feature requires:

Configuration

To exclude SaaS services from a Remote Access VPN tunnel in Hub mode:

  1. Connect with SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. to the Security Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server. / Domain Management Server that manages this Security Gateway / ClusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing..

  2. Configure Remote Access VPN.

    See Getting Started with Remote Access.

  3. Configure Hub Mode.

    See Hub Mode (VPN Routing for Remote Clients)

  4. Configure a dedicated encryption domain for Remote Access VPN.

    See Advanced VPN Domain Configuration

  5. From the left navigation panel, click Gateways & Servers.

  6. Open the Security Gateway / Cluster object:

    1. In the left navigation tree, click Network Management > VPN Domain.

    2. Select User defined.

    3. In the Encryption Domain field, select the Group object you configured for the Remote Access VPN community.

    4. In this Group object, add a nested Simple Group object with a name that begins with:

      exclusions_

      Important - Dynamic Split Tunneling uses this nested group. Therefore, this Simple Group object can include objects only from these types: Updatable, Dynamic, or Domain.

    5. Add the applicable object for your SaaS to this nested group.

    6. Click OK.

  7. In SmartConsole, install the Access Control Policy on the Security Gateway / Cluster object.

To enable the feature on the Remote Access VPN client, do one of these:

    1. Connect to the command line on the Security Gateway / each Cluster MemberClosed Security Gateway that is part of a cluster..

    2. Log in to the Expert mode.

    3. Back up the current $FWDIR/conf/trac_client_1.ttm file:

      cp -v $FWDIR/conf/trac_client_1.ttm{,_BKP}

    4. Edit the current $FWDIR/conf/trac_client_1.ttm file:

      vi $FWDIR/conf/trac_client_1.ttm

    5. In the main parameter "trac_client_1", add the new parameter "split_tunnel" as appears below:

      Copy 
      (
          :trac_client_1 (
              :split_tunnel (
                  :gateway (
                      :default (true)
                  )
              )

              :<other_parameters> (
              ... ...
              )
          )
      )

    6. Save the changes in the file and exit the editor.

    7. In SmartConsole, install the Access Control policy on the Security Gateway / Cluster Object.

    The feature is available on the VPN client after the administrator makes a new connection between the Security Gateway and a Remote Access VPN tunnel.

  		•

    Note - For information on how to prepare an installation package with the VPN Configuration Utility, see sk122574.

    1. Go to the VPN client installation directory:

      Operating System

      Default Path

      Windows OS 32-bit

      One of these:

      • %ProgramFiles%\CheckPoint\Endpoint Security\Endpoint Connect\

      • %ProgramFiles%\CheckPoint\Endpoint Connect\

      Windows OS 64-bit

      One of these:

      • %ProgramFiles(x86)%\CheckPoint\Endpoint Security\Endpoint Connect\

      • %ProgramFiles(x86)%\CheckPoint\Endpoint Connect\

      macOS

      /Library/Application Support/Checkpoint/Endpoint Security/Endpoint Connect/

    2. Create a copy of the current trac.defaults file.

    3. Edit the current trac.defaults file with an advanced plain-text editor (such as Notepad++, UltraEdit, PSPad).

    4. Configure the value of the "split_tunnel" parameter to "true":

      split_tunnel        STRING        true        GW_USER    0

      Important - Do not change other predefined strings in this line - "STRING", "GW_USER", and "0".

    5. Save your changes and close the file.

    6. Restart the computer with the VPN client installed.

    The VPN client starts to exclude SaaS services the next time it creates a new Remote Access VPN tunnel to the Security Gateway.