I have a situation where our Windows 7 clients (Windows 10 works ok) are having intermittent connectivity issues when connecting over our Checkpoint Endpoint Connect VPN. The issue manifests itself as a more specific route addition for a particular host on our internal network that tries to route traffic outside the VPN when it should not be.
User A is at home on private network 192.168.1.100. This user connects to corporate network via said Checkpoint VPN, gets private network address of 10.1.7.100 for said tunnel. This connection instantiation is a hybrid type where traffic destined for public IP space flows out through the 192.168.1.0/24 network and is NAT'd to public IP space, and traffic destined for our private resources flow across the VPN. This works for almost everything we use except one .net application. That application uses HTTP REST to communicate with an internal server at 10.1.4.50.
We have a route in the VPN client config for 10.1.4.0/24 that sends all 10.1.4 traffic out the VPN Gateway address at the other side of our tunnel at metric 1.
When the problem occurs we see a routing table change that inserts a more specific route for the destination servers IP only (in this case 10.1.4.50), with a metric of 11 and a Gateway of 192.168.1.1 (this is the default gw for the base interface the tunnel sits on top of). When this route goes active everything fails for that destination server only because it is routed outside the tunnel. Other traffic destined for other hosts on any of our internal networks still works ok including other hosts on 10.1.4.0/24.
We have consulted with Checkpoint and they say that their client does not insert spurious routes into the IP stack like this once the tunnel is setup so it must be something else. But finding what is inserting said route and why is proving very hard.
I have been using some utilities from NirSoft to view realtime route changes, and I have also explored some C++ utils that use NotifyRouteChange to display route change activity, but none of these give me the level of detail I really need, which is to find which process actually did the insertion of the route.
Can someone tell me how to find the process name or ID that is doing route modifications? Or recommend an alternative to determine which process is actually doing the bad things to my route tables? IF it really is Checkpoints VPN software, I can force the issue with them. But without other evidence, I am somewhat stuck.
Thanks for any help!
