A practical help desk workflow for VPN split-tunnel exceptions, evidence, bounded authority, testing, and verified closure.
Direct answer
Operational guidance
Published October 13, 2026. Document VPN Split-Tunnel Exceptions for Review starts when VPN split-tunnel exceptions affects a customer or operating queue. The immediate goal is not to guess a cause. It is to preserve the reported state, prevent an irreversible shortcut, and move a decision-ready record to the network security owner. Open case OHS13-B5 with local time, impact, safe state, and promised update.
Define the support record
For VPN split-tunnel exceptions, checkpoint OHS13-B5-1 records the authoritative source, system state, observed symptom, instruction version, actor, timestamp and zone, customer-visible effect, current owner, due point, correction history, and destination receipt. During define the support record, test an ordinary case, missing evidence, conflicting signals, unavailable owner, denied action, system interruption, downstream rejection, and correction after apparent completion. Frontline staff may gather facts, apply approved routine steps, and draft bounded updates; the network security owner retains security, privacy, identity, access, money, policy, and risk decisions. A pass requires source-linked evidence and attributable acceptance. A failure remains open with a stable reason and safe holding state; assignment, silence, or a closed label does not prove the outcome. Preserve contradictions instead of selecting a convenient explanation, and never request credentials, tokens, or restricted data to make the ticket look complete.
Give a safe first response
For VPN split-tunnel exceptions, checkpoint OHS13-B5-2 records the authoritative source, system state, observed symptom, instruction version, actor, timestamp and zone, customer-visible effect, current owner, due point, correction history, and destination receipt. During give a safe first response, test an ordinary case, missing evidence, conflicting signals, unavailable owner, denied action, system interruption, downstream rejection, and correction after apparent completion. Frontline staff may gather facts, apply approved routine steps, and draft bounded updates; the network security owner retains security, privacy, identity, access, money, policy, and risk decisions. A pass requires source-linked evidence and attributable acceptance. A failure remains open with a stable reason and safe holding state; assignment, silence, or a closed label does not prove the outcome. Preserve contradictions instead of selecting a convenient explanation, and never request credentials, tokens, or restricted data to make the ticket look complete.
Keep the authority line visible
For VPN split-tunnel exceptions, checkpoint OHS13-B5-3 records the authoritative source, system state, observed symptom, instruction version, actor, timestamp and zone, customer-visible effect, current owner, due point, correction history, and destination receipt. During keep the authority line visible, test an ordinary case, missing evidence, conflicting signals, unavailable owner, denied action, system interruption, downstream rejection, and correction after apparent completion. Frontline staff may gather facts, apply approved routine steps, and draft bounded updates; the network security owner retains security, privacy, identity, access, money, policy, and risk decisions. A pass requires source-linked evidence and attributable acceptance. A failure remains open with a stable reason and safe holding state; assignment, silence, or a closed label does not prove the outcome. Preserve contradictions instead of selecting a convenient explanation, and never request credentials, tokens, or restricted data to make the ticket look complete.
Run the handoff in observable stages
For VPN split-tunnel exceptions, checkpoint OHS13-B5-4 records the authoritative source, system state, observed symptom, instruction version, actor, timestamp and zone, customer-visible effect, current owner, due point, correction history, and destination receipt. During run the handoff in observable stages, test an ordinary case, missing evidence, conflicting signals, unavailable owner, denied action, system interruption, downstream rejection, and correction after apparent completion. Frontline staff may gather facts, apply approved routine steps, and draft bounded updates; the network security owner retains security, privacy, identity, access, money, policy, and risk decisions. A pass requires source-linked evidence and attributable acceptance. A failure remains open with a stable reason and safe holding state; assignment, silence, or a closed label does not prove the outcome. Preserve contradictions instead of selecting a convenient explanation, and never request credentials, tokens, or restricted data to make the ticket look complete.
Anticipate misleading signals
For VPN split-tunnel exceptions, checkpoint OHS13-B5-5 records the authoritative source, system state, observed symptom, instruction version, actor, timestamp and zone, customer-visible effect, current owner, due point, correction history, and destination receipt. During anticipate misleading signals, test an ordinary case, missing evidence, conflicting signals, unavailable owner, denied action, system interruption, downstream rejection, and correction after apparent completion. Frontline staff may gather facts, apply approved routine steps, and draft bounded updates; the network security owner retains security, privacy, identity, access, money, policy, and risk decisions. A pass requires source-linked evidence and attributable acceptance. A failure remains open with a stable reason and safe holding state; assignment, silence, or a closed label does not prove the outcome. Preserve contradictions instead of selecting a convenient explanation, and never request credentials, tokens, or restricted data to make the ticket look complete.
Use customer language that matches evidence
For VPN split-tunnel exceptions, checkpoint OHS13-B5-6 records the authoritative source, system state, observed symptom, instruction version, actor, timestamp and zone, customer-visible effect, current owner, due point, correction history, and destination receipt. During use customer language that matches evidence, test an ordinary case, missing evidence, conflicting signals, unavailable owner, denied action, system interruption, downstream rejection, and correction after apparent completion. Frontline staff may gather facts, apply approved routine steps, and draft bounded updates; the network security owner retains security, privacy, identity, access, money, policy, and risk decisions. A pass requires source-linked evidence and attributable acceptance. A failure remains open with a stable reason and safe holding state; assignment, silence, or a closed label does not prove the outcome. Preserve contradictions instead of selecting a convenient explanation, and never request credentials, tokens, or restricted data to make the ticket look complete.
Test before relying on the workflow
For VPN split-tunnel exceptions, checkpoint OHS13-B5-7 records the authoritative source, system state, observed symptom, instruction version, actor, timestamp and zone, customer-visible effect, current owner, due point, correction history, and destination receipt. During test before relying on the workflow, test an ordinary case, missing evidence, conflicting signals, unavailable owner, denied action, system interruption, downstream rejection, and correction after apparent completion. Frontline staff may gather facts, apply approved routine steps, and draft bounded updates; the network security owner retains security, privacy, identity, access, money, policy, and risk decisions. A pass requires source-linked evidence and attributable acceptance. A failure remains open with a stable reason and safe holding state; assignment, silence, or a closed label does not prove the outcome. Preserve contradictions instead of selecting a convenient explanation, and never request credentials, tokens, or restricted data to make the ticket look complete.
Measure outcomes instead of ticket motion
For VPN split-tunnel exceptions, checkpoint OHS13-B5-8 records the authoritative source, system state, observed symptom, instruction version, actor, timestamp and zone, customer-visible effect, current owner, due point, correction history, and destination receipt. During measure outcomes instead of ticket motion, test an ordinary case, missing evidence, conflicting signals, unavailable owner, denied action, system interruption, downstream rejection, and correction after apparent completion. Frontline staff may gather facts, apply approved routine steps, and draft bounded updates; the network security owner retains security, privacy, identity, access, money, policy, and risk decisions. A pass requires source-linked evidence and attributable acceptance. A failure remains open with a stable reason and safe holding state; assignment, silence, or a closed label does not prove the outcome. Preserve contradictions instead of selecting a convenient explanation, and never request credentials, tokens, or restricted data to make the ticket look complete.
Verify destination acceptance
For VPN split-tunnel exceptions, checkpoint OHS13-B5-9 records the authoritative source, system state, observed symptom, instruction version, actor, timestamp and zone, customer-visible effect, current owner, due point, correction history, and destination receipt. During verify destination acceptance, test an ordinary case, missing evidence, conflicting signals, unavailable owner, denied action, system interruption, downstream rejection, and correction after apparent completion. Frontline staff may gather facts, apply approved routine steps, and draft bounded updates; the network security owner retains security, privacy, identity, access, money, policy, and risk decisions. A pass requires source-linked evidence and attributable acceptance. A failure remains open with a stable reason and safe holding state; assignment, silence, or a closed label does not prove the outcome. Preserve contradictions instead of selecting a convenient explanation, and never request credentials, tokens, or restricted data to make the ticket look complete.
Close with durable evidence
For VPN split-tunnel exceptions, checkpoint OHS13-B5-10 records the authoritative source, system state, observed symptom, instruction version, actor, timestamp and zone, customer-visible effect, current owner, due point, correction history, and destination receipt. During close with durable evidence, test an ordinary case, missing evidence, conflicting signals, unavailable owner, denied action, system interruption, downstream rejection, and correction after apparent completion. Frontline staff may gather facts, apply approved routine steps, and draft bounded updates; the network security owner retains security, privacy, identity, access, money, policy, and risk decisions. A pass requires source-linked evidence and attributable acceptance. A failure remains open with a stable reason and safe holding state; assignment, silence, or a closed label does not prove the outcome. Preserve contradictions instead of selecting a convenient explanation, and never request credentials, tokens, or restricted data to make the ticket look complete.
Put the workflow into service
For VPN split-tunnel exceptions, checkpoint OHS13-B5-11 records the authoritative source, system state, observed symptom, instruction version, actor, timestamp and zone, customer-visible effect, current owner, due point, correction history, and destination receipt. During put the workflow into service, test an ordinary case, missing evidence, conflicting signals, unavailable owner, denied action, system interruption, downstream rejection, and correction after apparent completion. Frontline staff may gather facts, apply approved routine steps, and draft bounded updates; the network security owner retains security, privacy, identity, access, money, policy, and risk decisions. A pass requires source-linked evidence and attributable acceptance. A failure remains open with a stable reason and safe holding state; assignment, silence, or a closed label does not prove the outcome. Preserve contradictions instead of selecting a convenient explanation, and never request credentials, tokens, or restricted data to make the ticket look complete.
Review the source and improve the system
For VPN split-tunnel exceptions, checkpoint OHS13-B5-12 records the authoritative source, system state, observed symptom, instruction version, actor, timestamp and zone, customer-visible effect, current owner, due point, correction history, and destination receipt. During review the source and improve the system, test an ordinary case, missing evidence, conflicting signals, unavailable owner, denied action, system interruption, downstream rejection, and correction after apparent completion. Frontline staff may gather facts, apply approved routine steps, and draft bounded updates; the network security owner retains security, privacy, identity, access, money, policy, and risk decisions. A pass requires source-linked evidence and attributable acceptance. A failure remains open with a stable reason and safe holding state; assignment, silence, or a closed label does not prove the outcome. Preserve contradictions instead of selecting a convenient explanation, and never request credentials, tokens, or restricted data to make the ticket look complete.
