Re: [FW-1] SSL VPN performance vs. SecureClient

2007-10-24 Thread Hugo van der Kooij
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ray wrote: >> - (depending on the usage) no additional software to install > > There's always extra software to install unless you're just doing HTTPS > connections. Whether it's installed by you or by download (and you have to > give the end user e

Re: [FW-1] SSL VPN performance vs. SecureClient

2007-10-24 Thread Ray
> - (depending on the usage) no additional software to install There's always extra software to install unless you're just doing HTTPS connections. Whether it's installed by you or by download (and you have to give the end user elevated rights, which causes a whole different set of problems), y

Re: [FW-1] SSL VPN performance vs. SecureClient

2007-10-24 Thread Robby Cauwerts
On 10/24/07, sin <[EMAIL PROTECTED]> wrote: > > Robby Cauwerts wrote: > > On 10/24/07, Hugo van der Kooij <[EMAIL PROTECTED]> wrote: > >> > >> Given the choice between SSL VPN and IPSEC VPN I will choose IPSEC 8 > >> days of the week. > >> > >> > >> Hugo. > > > > > > Why? > > I only see benefits wh

[FW-1] Checkpoint QOS VOIP configuration

2007-10-24 Thread Mick Reay
Hi. Has anyone set up QOS for VOIP on Checkpoint using Diffserv or LLC? Any recommendations regarding procedure and constant bitrate/maximal delay would be greatly appreciated, thanks Mick. = To set vacation, Out-Of-Office, or away m

Re: [FW-1] SSL VPN performance vs. SecureClient

2007-10-24 Thread Cory Rau
On Oct 24, 2007, at 2:03 PM, Hugo van der Kooij wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cory Rau wrote: We've recently replaced our 2 Nokia IP330's with UTM-1 2050's. We used to provide remote access to our salespeople via SecureClient (they're mostly Mac). The circuit to our

Re: [FW-1] SSL VPN performance vs. SecureClient

2007-10-24 Thread sin
Robby Cauwerts wrote: On 10/24/07, Hugo van der Kooij <[EMAIL PROTECTED]> wrote: Given the choice between SSL VPN and IPSEC VPN I will choose IPSEC 8 days of the week. Hugo. Why? I only see benefits when using SSL VPN's instead of IPSEC VPN's, as discussed over and over: - (depending on th

Re: [FW-1] SSL VPN performance vs. SecureClient

2007-10-24 Thread Robby Cauwerts
On 10/24/07, Hugo van der Kooij <[EMAIL PROTECTED]> wrote: > > > Given the choice between SSL VPN and IPSEC VPN I will choose IPSEC 8 > days of the week. > > > Hugo. Why? I only see benefits when using SSL VPN's instead of IPSEC VPN's, as discussed over and over: - (depending on the usage) no add

Re: [FW-1] Details of my NIC problems with SecurePlatform R65...

2007-10-24 Thread Hugo van der Kooij
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris van der Merwe wrote: > Hi Guys, > > Thanks to everyone who offered ideas. In the end, I tried taking the Quad > card out of the box and SecurePlatform could not actually start the > networking anymore. But with a quick re-install of SecurePlat

Re: [FW-1] SSL VPN performance vs. SecureClient

2007-10-24 Thread Hugo van der Kooij
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cory Rau wrote: > We've recently replaced our 2 Nokia IP330's with UTM-1 2050's. We used > to provide remote access to our salespeople via SecureClient (they're > mostly Mac). The circuit to our main office is only a T1 but > performance was always q

[FW-1] SSL VPN performance vs. SecureClient

2007-10-24 Thread Cory Rau
We've recently replaced our 2 Nokia IP330's with UTM-1 2050's. We used to provide remote access to our salespeople via SecureClient (they're mostly Mac). The circuit to our main office is only a T1 but performance was always quite acceptable mainly because they're running Citrix connectio

[FW-1] Troubling NAT Issue - NGX R62

2007-10-24 Thread Larson, Todd (LNG-DAY)
Steve, Yes we have a outbound NAT rule configured, it should not need it though as the device in the DMZ never initiates a connection out through the firewall. From: Steve Baker [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 24, 2007 10:42 AM To: Larso

Re: [FW-1] Troubling NAT Issue - NGX R62

2007-10-24 Thread Larson, Todd (LNG-DAY)
Paolo, Thank you for your response, we've already checked that and SecureXL is disabled (we also tried setting ipso flows to slowpath). I'm thinking the issue is more layer 2 between the firewall and upstream switch, we just can't get it isolated. -Original Message- From: Mailing list fo

Re: [FW-1] Remote VPN Gateway can't be reached by HTTPs

2007-10-24 Thread Steve Baker
If I understand you correctly, the VPN device on the other side and the webserver, which is accessable via HTTP (443) have the same IP. Assuming that you do not have to pass HTTPS over the VPN tunnel for any other reason (i.e. to another server) you could also go into the VPN community advanced pro

Re: [FW-1] Details of my NIC problems with SecurePlatform R65...

2007-10-24 Thread Chris van der Merwe
Hi Guys, Thanks to everyone who offered ideas. In the end, I tried taking the Quad card out of the box and SecurePlatform could not actually start the networking anymore. But with a quick re-install of SecurePlatform, everything worked fine (with just the 2 onboard NIC's installed). So, now it

Re: [FW-1] Remote VPN Gateway can't be reached by HTTPs

2007-10-24 Thread pkc_mls
Rafaël Olivier a écrit : Hi, Thanks for your answers ! The connection to webserver is supposed to go directly on the Internet, not through the VPN Tunnel. So, VPN errors should not occur. But the webserver and remote gateway (for Site2Site VPN) are the same machine (same IP). That may confl

Re: [FW-1] Remote VPN Gateway can't be reached by HTTPs

2007-10-24 Thread Rafaël Olivier
Hi, Thanks for your answers ! The connection to webserver is supposed to go directly on the Internet, not through the VPN Tunnel. So, VPN errors should not occur. But the webserver and remote gateway (for Site2Site VPN) are the same machine (same IP). That may conflict. (I already opened a c

Re: [FW-1] Remote VPN Gateway can't be reached by HTTPs

2007-10-24 Thread Paolo
Hi the webserver has to be reached by the tunnel or by internet directly? when you write: => we setup a rule to allow this connection, directly, not through the VPN Tunnel it seems to be in clear (no in tunnel), is it right? And I agree pkc if it has to pass through the tunnel you should c

Re: [FW-1] Remote VPN Gateway can't be reached by HTTPs

2007-10-24 Thread pkc_mls
Rafaël Olivier a écrit : Hello All, Hi, We setup a Site2Site VPN with a customer. This VPN Tunnel is correctly working. The customer is asking us to access a webserver which is hosted on the remote VPN gateway, on port 443. (so remote VPN Gateway is managing the Site2Site VPN and the Webse

Re: [FW-1] Troubling NAT Issue - NGX R62

2007-10-24 Thread Paolo
HI, try to disable Secure XL whit cpconfig. I have a case for these issue, almost the same behavior. ciao -- Paolo Riviello Mob. +39.328.1749468 Home: http://www.paoloriviello.com E-mail: [EMAIL PROTECTED] Msn: [EMAIL PROTECTED] Skype: pao_rivi -I'm a rebel, soul rebel I'm a capturer,

Re: [FW-1] SmartView tracker R65

2007-10-24 Thread stromsec
It is fixed in HFA01. 2007/10/24, Tom Louis <[EMAIL PROTECTED]>: > > It is a lovely feature that I hope they can fix soon, I brought it to > there > attention as soon as R65 came out. > > = > To set vacation, Out-Of-Office, or away messages, > send

[FW-1] Remote VPN Gateway can't be reached by HTTPs

2007-10-24 Thread Rafaël Olivier
Hello All, We setup a Site2Site VPN with a customer. This VPN Tunnel is correctly working. The customer is asking us to access a webserver which is hosted on the remote VPN gateway, on port 443. (so remote VPN Gateway is managing the Site2Site VPN and the Webserver) => we setup a rule to a