topic Re: I cannot access to portal ssl network extender in Firewall and Security Management

I cannot access to portal ssl network extender

Joseflorez — Sat, 23 Jan 2021 02:14:47 GMT

I am having problems when trying to load the SSL Network Extender portal of one of the firewalls that I administer, I have compared the general configuration of IPsec and Remote Access of another firewall that works correctly and is the same configuration. What would you recommend me to review specifically?

The authentication method is Legacy so I don't have certificates

Re: I cannot access to portal ssl network extender

Joseflorez — Sat, 23 Jan 2021 02:22:40 GMT

i have disabled the blade mobile access, everything had worked so far with ipsecVPN

Re: I cannot access to portal ssl network extender

PhoneBoy — Sat, 23 Jan 2021 07:04:25 GMT

What version/JHF level?
Are you referring the Mobile Access portal or the SNX portal (which is used to allow download of the SNX client when MAB is not used)?
Screenshot of what you see when you access the portal?

Re: I cannot access to portal ssl network extender

Joseflorez — Sat, 23 Jan 2021 12:03:04 GMT

Hi PhoneBoy

HOTFIX_R80_10_JUMBO_HF Take: 279

I refer this portal SSL Network Extender, This is how it should work

Re: I cannot access to portal ssl network extender

Joseflorez — Sat, 23 Jan 2021 12:07:21 GMT

Hi PhoneBoy

HOTFIX_R80_10_JUMBO_HF Take: 279

I refer this portal SSL Network Extender, This is how it should work

but when i try to the load of url by other gateway appear this form

Re: I cannot access to portal ssl network extender

PhoneBoy — Sat, 23 Jan 2021 18:32:22 GMT

Do you have an explicit rule in your access policy to allow this connection?

As a separate issue I recommend upgrading from R80.10 since it will be officially End of Support in the next few months.

Re: I cannot access to portal ssl network extender

Joseflorez — Sat, 23 Jan 2021 19:03:35 GMT

No, i dont have an explicit rule to allow this connection. This connection do match with the implied rule, and now see an drop

How could I allow the connection? Could this have any repercussions? Modify the implied rule

Re: I cannot access to portal ssl network extender

PhoneBoy — Sat, 23 Jan 2021 22:54:38 GMT

There's an SK about that.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk134872&partition=Advanced&product=Mobile

Re: I cannot access to portal ssl network extender

the_rock — Sun, 24 Jan 2021 04:12:54 GMT

As soo as I saw your response, first thing that popped into my head was possibility of MA and gaia portal using same port number. PLEASE ENSURE they are different and then push the policy and let us know.

Andy

Re: I cannot access to portal ssl network extender

Joseflorez — Tue, 26 Jan 2021 02:02:54 GMT

When i do this SK, now i can to access, but to gaia portal not portal SSL Network Extender to connect to VPN. What else can I do?

Re: I cannot access to portal ssl network extender

the_rock — Tue, 26 Jan 2021 02:05:39 GMT

Hang on...so what port is your Gaia portal now? Message me offline, lets do remote session, I want to see this. Something does not make sense.

Andy

Re: I cannot access to portal ssl network extender

Joseflorez — Tue, 26 Jan 2021 02:14:21 GMT

my port gaia now is 4434 but the 443 still works, where would the remote session be?

Re: I cannot access to portal ssl network extender

the_rock — Tue, 26 Jan 2021 03:05:30 GMT

Hey D,

I did remote session with Jose and helped him fix it. All it was is that in gaia portal, if you change port to non-standard, it changes option "according to policy", so then explicit rule is needed to allow access externally. If you just need it internally, then changing port to 4434 fpr example works for Gaia and also works on port 443 for snx. So Jose was fine with that and now he knows what to do in case they need to allow it on external interface. Thanks as always!

Andy

Re: I cannot access to portal ssl network extender

PhoneBoy — Tue, 26 Jan 2021 04:02:11 GMT

Nice work 🙂