> Source: [sk170061](https://support.checkpoint.com/results/sk/sk170061)

# sk170061 - Capsule Connect \ Capsule VPN - DNS-based MEP

| Property | Value |
|----------|-------|
| Solution ID | sk170061 |
| Date Created | 2020-10-25 |
| Last Modified | 2022-02-10 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | Android, iOS |
| Platform | Mobile Devices |

## Solution

**Capsule Connect \\ Capsule VPN (iOS \\ Android) does not currently support full MEP, but a basic DNS-based solution is possible.**   

With this solution, the DNS server is configured with all the Security Gateway IP addresses, and controls which one is returned on DNS queries that the client makes. This can be controlled by a DNS policy with rules based on either the geographic location of the client (GeoDNS) and\\or other load balancing logic (from a basic round-robin, cycling through the list of IP addresses, to a much more elaborate policy). See the DNS server documentation for more info, [for example](https://docs.microsoft.com/en-us/windows-server/networking/dns/deploy/app-lb).  

No special configuration is required on the client, only that the site be configured with its FQDN, and not with an explicit IP address. The Capsule app makes a DNS request to resolve the site name on every connect or reconnect, thus enabling the switch to a different Security Gateway each time, based on the returned DNS resolved address.   

In order to make this transition between Security Gateways smooth and transparent, all the Security Gateways must have their portal certificate with the same CN and same issuer (CA). Otherwise, a warning of trust will be presented to the user every time it switches Security Gateways.

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content