My CP NG AI is running on a Dell 1650. I have it installed as both an Enforcement Module and as the Primary Management Server. In my test lab setup, I had a seperate NG AI Management station and 1 Enforcement module. The secure remote works just fine in the test lab.
Is there something conflicting because I have both the Enforcement and Primary Management server running on the same platform? I think I recall something about the Internal CA having issues if something has the same name or something. Does anyone know something about this? Again, when I create the site for the first time, the topology downloads, but then it freezes after that. -----Original Message----- From: O'Flynn, Derek [mailto:[EMAIL PROTECTED] Sent: Thursday, November 20, 2003 11:21 PM To: [EMAIL PROTECTED] Subject: Re: [FW-1] CP NG AI Secure Remote Issue I had the same problem, and we aren't using SecureClient. I ended up using IP Pools to handle it. You have to configure it in a few places, but it basically NATs their address to a subnet you give them. Check SK, it should have documentation on using IP Pools, but if you can't find it, just post back here, I'll try to document it for you tomorrow when I'm at work. Derek -----Original Message----- From: Jon Allingham [mailto:[EMAIL PROTECTED] Sent: Thursday, November 20, 2003 6:54 PM To: [EMAIL PROTECTED] Subject: Re: [FW-1] CP NG AI Secure Remote Issue Don't know if it applies here, but if the client is behind a NAT device (likely since you reference a 192 IP), the private IP will be the address seen by your firewall, not the NATed address because the tunnel goes right through the NAT device. Many routers by default don't route 192 addresses (sometimes they even screen them out.) If you have any 192 routes in your internal network, you may be running into the problem that the return path is not getting routed properly. This is a general problem because multiple people will all come in as 192.168.1.100 (default for every linksys router) and things get confused. We had the problem that we use 192.168.2-100 for other things and suddenly we had users trying to come in on something other than 192.168.1 and it didn't work. We tried manually assigning people starting addresses on their private networks but it is a pain to administer for more than a few people. Since you are running NG, you may want to consider switching to "connect" mode with Secure Client instead of transparent mode. Configure your firewall to hand out a set of IP addresses not in your encryption domain. Make sure those addresses are routable through your firewall. Then, when users connect, they will get a miniport created with one of your assigned IP addresses (DHCP-lite if you will.) It avoids conflicting users all having the same IP address and precludes unexpected routing conflicts. -- Jon Allingham Director, IVT Leapstone Systems -----Original Message----- From: Rindee [mailto:[EMAIL PROTECTED] Sent: Thursday, November 20, 2003 5:55 PM To: [EMAIL PROTECTED] Subject: Re: [FW-1] CP NG AI Secure Remote Issue I am not sure about the other person, but our internal is 10.x.x.x and IP of host is 192.x.x.x That was my first thought. I am wondering if it is a routing issue in our router? I am frustrated. -----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Scott Friedman Sent: Thursday, November 20, 2003 2:07 PM To: [EMAIL PROTECTED] Subject: Re: [FW-1] CP NG AI Secure Remote Issue Are you using the same IP/subnet mask on your client that is being Used anywhere in the Encryption Domain/Topology on the Main Site? That is usually the main culprit.. Look for any network objects with the same IP/mask that your using.. Then try changing your Securemote client to another range Scott Friedman Security Engineer - NG CCSE [EMAIL PROTECTED] Advanced Network Solutions 1750 S. Telegraph Rd Suite 100 Bloomfield Hills, MI 48302 (248) 857-5526 x132 www.advnetworks.com -----Original Message----- From: David Walker [mailto:[EMAIL PROTECTED] Sent: Thursday, November 20, 2003 3:40 PM To: [EMAIL PROTECTED] Subject: [FW-1] CP NG AI Secure Remote Issue Group, I've installed Checkpoint NG with AI. It has a public IP address and it is configured for Secure Remote access. When I connect to the it via the Secure Remote for the first time, it prompts me for my username/password, tells me I'm authenticated, displays the certificate, and downloads the topology. When I try to access the 1 server within the encryption domain, I receive ERROR: COMMUNICATION WITH GATEWAY x.x.x.x HAS FAILED. When I attempt to update the site within the Secure Remote program, I recieve the same error. The logs show the initial logon and topology download, but nothing else after that. When doing a tcpdump on the external interface of the firewall, I see the incoming and outgoing packets from/to Secure Remote client initially, but again nothing after that. It's almost like the Secure Remote client is preventing access. If I stop Secure Remote on the laptop, I am able to TELNET to the firewall. I'm using a laptop with WinXP, latest Secure Remote NG with AI, I've stop IPSEC services (Checkpoint recommendation). Have tried via dialup and direct broadband. The rule is at the top on my policy. Any suggestions? David ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
