Greetings again, all. Now that our office-mode WLAN users can connect via SecureClient thru two separate interfaces (WLAN and outside) by disabling office-mode anti-spoofing it's time for me to get those users connecting to the internet.
Currently, the only way that the WLAN users can connect to the internet is if the "Route all traffic thru gateway" is set. That isn't realistic because when a user is at home I don't want all their traffic eating up our bandwidth. I don't have any rules allowing traffic from the WLAN IP addresses to the outside. The rules I've have for SR/SC are as follows... # | Source | Dst | VPN | Service | Action ---+-------------------+-----+--------------+----------------+---------- 50 | [EMAIL PROTECTED] | Any | RemoteAccess | Any | accept 51 | [EMAIL PROTECTED] | Any | Any Traffic | http,https,ftp | User Auth 52 | [EMAIL PROTECTED] | Any | RemoteAccess | Any | accept 53 | [EMAIL PROTECTED] | Any | Any Traffic | http,https,ftp | User Auth If I have the "Route all traffic thru gateway" set and I hit Yahoo from a machine it is allowed via Rule 50 (I'm in the Admins group). However, if I don't have "Route all..." set and I try to hit Yahoo from the office-mode WLAN it is blocked by my Any-Any drop rule at the bottom of my ruleset. That is presumably because I don't have a rule from the WLAN IPs to the Internet. The only time I want WLAN IPs to have access to the Internet is if they are authenticated via SR/SC. Is it possible to simultaneously 1) Not have "Route all traffic thru gateway" set, but still 2) Only allow outgoing internet traffic to those that have authenticated via SR/SC? I know that when the users are on the WLAN that all traffic /will/ be routed thru the gateway, but if it's not in the encryption domain I don't care about it being encrypted by SR/SC. I would be happy to provide any additional information. Thanks! Geoff Brisbine | Network Administrator MI-Assistant - A Division of Fiserv FSC, Inc. 26550 West Mondovi Street | Eleva, WI 54738 Phone: 715.287.4262 | Fax: 715.287.4576 ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
