With SC you can assign IPs via OfficeMode from a range on your internal network. Such that OfficeMode is used and assigns x.x.x.101-111 from your internal network. SC works like MSPPTP, and adds a firewall piece as well. Of course you still can't connect and have login scripts and drive mappings work as easily as you can with MS PPTP. Ugh, don't get me started, CheckPoint remote access VPN should get an F on usability.
Derek O'Flynn -----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of David Strom Sent: Friday, June 10, 2005 2:24 PM To: [email protected] Subject: Re: [FW-1] VPN ip pool I beg to differ... SR is bundled with VPN. We paid for VPN-1 for the sole reason to provide remote access. AND an encryption accelerator card. AND maintenance/support on each, ever since (3 years now). Money wasted. AND, even though the checkpoint tech rep promised this solution would work (just like MS PPTP, I asked explicitly), it does not. Besides, I don't think SecureClient will work... we did a quick eval test, and can't seem to find a way to assign a range of IP addresses to use within our LAN subnet, i.e., use IPs x.x.x.101-111 on our class C subnet. At least, not in the "Smartview Dashboard". Looked at SSL extender, didn't care for it, and it won't use our encryption accelerator. Guess you were lucky to have a budget for SC, and/or not to trust the Checkpoint sales people. -- David Strom no-need to-list wrote: > As always , we get what we paid for.....(SecureRemote is free!) > Use SecureClient, is not going to break your company budget....the license are concurrent users at any giving time....unless you have thousand of them login in at the same exact moment. > Another paying option is using SSL network extender...it uses HTTPS to create the tunnel in Office Mode..always picking up a defined pool of IP address immaterial where the users is login from. > > I gave up on SecureRemote as soon as I finish testing it.... > > > "O'Flynn, Derek" <[EMAIL PROTECTED]> wrote: > All in glorious detail my exchange with the bright minds at CheckPoint... > > My response to "it works this way"... > The functionality of the VPN server should not require me to monitor my end > users connectivity setup. If they come from a hotel/motel that has a > private NAT, this could collide with each other, and I have no control over > the remote installation of NAT. > > I need a procedure for allowing multiple users coming from different VPN > peers which may have the same source IP to get a separate IP on the SR NAT. > Or to not be DENIED access on the VPN because their point of origin has a > certain router subnet defined. > > The tracker logs record the connection as the following, so the gateway is > logging everything particular to the state of the connection so it should be > able to translate each session as an individual tunnel, not that userx and > usery have the same source IP, they still have different VPN peers, which > can distinguish them. > > VPN Peer > Source IP > Destination IP > Source Port > Destination Port > Xlate src > > Their response... > I have spoken to the escalation team and there is nothing that can be > changed. Securemote encrypts the packet at the client with the clients IP > address not the IP address of the NAT device. When the packet is decrypted > it is decrypted with the source IP. Just as you can't have two devices on > your network with the same IP addresses you can't have two vpn clients with > the same IP address. This is a limitation of TCP/IP not CheckPoint. We > developed office mode to overcome this limitation. The NAT device is part > of the vpn. You can have Securemote clients connecting from behind the the > same NAT device because each client has a unique source IP. > Can you put in a feature request to add an extra field to the state table > such that when a packet is decrypted from a certain VPN peer, it is > translated to a unique NAT IP. When this IP is then returned to the > gateway, it is then encrypted and sent to the proper VPN peer. > > My response... > Can you put in a feature request to add an extra field to the state table > such that when a packet is decrypted from a certain VPN peer, it is > translated to a unique NAT IP. When this IP is then returned to the > gateway, it is then encrypted and sent to the proper VPN peer. > > Their response... > You can submit an RFE the following link > > https://www.checkpoint.com/jsp/rfeLogin/login.jsp > > The problem with your proposed solution is that the encyrption takes place > at the client. The peer is the client, it is not the NAT device. The NAT > device is not part of the vpn. > > My response... > Actually the VPN peer is the public address of the NAT device. I can submit > logs to show that my enforcement point is already aware of this. > > I have VPN peer - Public IP > I have src IP - client's private nat address > > So you have all the information necessary to differentiate these > connections, it's just this would require major code revisions to take this > into account, and since you have a product that we can spend $50000 or more > on, it's not in checkpoints best interest. > > If I could utilize office mode in securemote then I would :( > > The other major players in this market allow this functionality for free, > just disappointed that something that's a major problem has not been > addressed. > > Derek O'Flynn > > > -----Original Message----- > From: Mailing list for discussion of Firewall-1 > [mailto:[EMAIL PROTECTED] On Behalf Of David Strom > Sent: Wednesday, June 08, 2005 3:09 PM > To: [email protected] > Subject: Re: [FW-1] VPN ip pool > > Did Checkpoint say *why* they did this "by design"? If it was a > mistake, then a big one, if not, then they're punishing those of us > using SecuRemote. And, Office Mode/Secure Client doesn't seem to > permit exactly the same type of configuration (range of IPs within the > local, vpn-ed to subnet). > > Maybe they messed up, & decided it was a good thing to force SR users to > pay for SC, so they decided it's a "design feature". > > -- > David Strom > > O'Flynn, Derek wrote: > > >>Just a note on this, if you use IP Pool NAT this does nothing to help >>endpoints that have the same source ip. For instance, two users behind >>routers at their house with 192.168.1.1 as their IP address. If they both >>connect at the same time, you will notice connectivity issues. I just >>recently worked with CheckPoint Support on this and they confirmed the > > issue > >>with me and verified it is by design, and to resolve it I'll need to > > upgrade > >>to SecureClient or have one of the end users change their router subnet. >> >>Derek O'Flynn >> >>-----Original Message----- >>From: Mailing list for discussion of Firewall-1 >>[mailto:[EMAIL PROTECTED] On Behalf Of Neil Kemp >>Sent: Sunday, June 05, 2005 2:46 AM >>To: [email protected] >>Subject: Re: [FW-1] VPN ip pool >> >>You can use IP Pools where you create an address range (has to be outside > > of > >>your Internal Network) and assign it. >> >>Works OK, done this a couple of times. >> >>-----Original Message----- >>From: Mailing list for discussion of Firewall-1 >>[mailto:[EMAIL PROTECTED] On Behalf Of Cem Akbas >>Sent: Saturday, June 04, 2005 8:31 AM >>To: [email protected] >>Subject: [FW-1] VPN ip pool >> >>Using VPN-1 - Securemote, how can i assign IP address to clients. Or >>is it possible only for SecureClient. >> >>Thanks >> >>================================================= >>To set vacation, Out-Of-Office, or away messages, >>send an email to [EMAIL PROTECTED] >>in the BODY of the email add: >>set fw-1-mailinglist nomail >>================================================= >>To unsubscribe from this mailing list, >>please see the instructions at >>http://www.checkpoint.com/services/mailing.html >>================================================= >>If you have any questions on how to change your >>subscription options, email >>[EMAIL PROTECTED] >>================================================= >> >> >> > > ############################################################################ > >>######### >>This e-mail message has been scanned for Viruses and Content and cleared >>by 3DMail >> > > ############################################################################ > >>######### >> >>================================================= >>To set vacation, Out-Of-Office, or away messages, >>send an email to [EMAIL PROTECTED] >>in the BODY of the email add: >>set fw-1-mailinglist nomail >>================================================= >>To unsubscribe from this mailing list, >>please see the instructions at >>http://www.checkpoint.com/services/mailing.html >>================================================= >>If you have any questions on how to change your >>subscription options, email >>[EMAIL PROTECTED] >>================================================= >> >>================================================= >>To set vacation, Out-Of-Office, or away messages, >>send an email to [EMAIL PROTECTED] >>in the BODY of the email add: >>set fw-1-mailinglist nomail >>================================================= >>To unsubscribe from this mailing list, >>please see the instructions at >>http://www.checkpoint.com/services/mailing.html >>================================================= >>If you have any questions on how to change your >>subscription options, email >>[EMAIL PROTECTED] >>================================================= > > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam protection around > http://mail.yahoo.com > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
