topic Re: Remote Access Endpoint VPN policy is not matching the rule in Firewall and Security Management

Remote Access Endpoint VPN policy is not matching the rule

Blason_R — Thu, 16 Dec 2021 03:41:51 GMT

Hi Team,

I have R80.30 firewalls and R80.40 mgmt server. It has been upgraded from R77.30 almost a year back and now I would like to enable Application and URL filtering blade on policy hence activated the same from Manage policy and layers.

However since I have Remote access Endpoint client based VPN rules setup in legacy mode like this

I am unable to do so and while installing policy it throws error. Then I tried converting legacy user access to access role however users are successfully getting authenticated but they are unable to connect as per policy and traffic is getting dropped on clean up rule. So I disabled Rule#9 and enabled Rule #8; however traffic is getting dropped any reason why?

Am I missing anything here?

Re: Remote Access Endpoint VPN policy is not matching the rule

Blason_R — Thu, 16 Dec 2021 03:49:29 GMT

Oh! By the way these are local users configured on firewall.

Re: Remote Access Endpoint VPN policy is not matching the rule

PhoneBoy — Fri, 17 Dec 2021 06:01:06 GMT

Have you enabled Remote Access as an Identity Source in the gateway?
It’s not enabled by default.

Re: Remote Access Endpoint VPN policy is not matching the rule

Blason_R — Mon, 20 Dec 2021 17:34:08 GMT

Yes this is enabled and I confirmed that. What could be other reason?

Re: Remote Access Endpoint VPN policy is not matching the rule

mcatanzaro — Tue, 21 Dec 2021 03:45:13 GMT

Hi,

I would check that the pdp is associating the AR with the users by running:

# pdp monitor user <user>

I would imagine this would be the cause if the IA settings etc. are correct.

Here is my user matching a rule correctly based off the AR detected by the pdp:

If the pdp isn't detecting the AR then you will want to recheck the configuration/debug pdpd to get more info.

Re: Remote Access Endpoint VPN policy is not matching the rule

Blason_R — Tue, 21 Dec 2021 03:49:01 GMT

Thanks I need to verify that. let me revert with my findings then.