topic Re: I cannot login VPN "site is not responding" Issues in Firewall and Security Management

I cannot login VPN "site is not responding" Issues

JordanHsu — Tue, 05 Sep 2023 09:58:54 GMT

Dear Sir,

I am Jordan from Taiwan and I am a newbie when it comes to CheckPoint Gateway.

I have encountered a sudden problem when I entered the command "fw unloadlocal" in my 6200 gateway's command line interface (CLI).

My mobile VPN function stopped working, and I have tried to find a lot of documentation to solve this issue, but without success.

I appreciate any assistance or guidance you can provide to help me resolve this matter.

Thank you for your support.

attachment

is my log and snapshot.

Re: I cannot login VPN "site is not responding" Issues

Lesley — Tue, 05 Sep 2023 10:33:19 GMT

This command removes installed policy from gateway. Are you able to reinstall to policy on the 6200 cluster?

If not try fw fetch

Re: I cannot login VPN "site is not responding" Issues

G_W_Albrecht — Tue, 05 Sep 2023 10:42:36 GMT

Also a reboot should be able to heal it. But why use the command "fw unloadlocal" at all ? Should not be needed except in very special situations (when you did something completely wrong in rule base so SMS can not reach it after policy install).

Re: I cannot login VPN "site is not responding" Issues

JordanHsu — Wed, 06 Sep 2023 01:25:14 GMT

Hello Albrecht,

Thank you for replied, Because somehow i have issue form the Gateway ,Such as webGui didn't work.

That's very strange , When i installed the policy my web-GUI function will going to down. Even i try to use port :4434 ,

If i meet this situation i must be use the commend to unload then install roll back.

Unfortunately reboot didn't worked. for my Mobile VPN..

Re: I cannot login VPN "site is not responding" Issues

JordanHsu — Wed, 06 Sep 2023 01:30:31 GMT

Hello Lesley,

Thanks you for the replied

Yes, i see the command will be removed all policy,

When i do this then i will reinstall back the the policy.

However how do i use the command of "fw fetch" , What does the command function to what ?

Re: I cannot login VPN "site is not responding" Issues

G_W_Albrecht — Wed, 06 Sep 2023 11:21:19 GMT

R81.10 Quantum Security Gateway Guide - fw fetch

Seems your policy does something wrong if WebGUI is blocked.

Re: I cannot login VPN "site is not responding" Issues

the_rock — Wed, 06 Sep 2023 19:19:52 GMT

Just to clarify, say if initial policy loads on the fw, that would ONLY allow web UI access on port 443, not any other port. What happens when you install basic policy to the gateway, can you ping say google dns, 8.8.8.8?

If not, can you verify SIC is okay? Also, its possible that something with the routing could be wrong...just do basic test ip r g 8.8.8.8 command and you can verify.

Andy

Re: I cannot login VPN "site is not responding" Issues

PhoneBoy — Thu, 07 Sep 2023 00:12:36 GMT

When you unload the policy with fw unloadlocal, it also affects VPN functionality.
Obviously, you have some issue with your policy that you need to correct.
This is likely something you will need the TAC to assist with: https://help.checkpoint.com

Re: I cannot login VPN "site is not responding" Issues

JordanHsu — Thu, 07 Sep 2023 01:17:51 GMT

Hello Rock,

Yes, from my firewall that would able to ping Google DNS

Also i already use IP pool from my Gateway provided , So that's probably not a policy issue.

BTW, i try to access my FW via GUI with port 443 that did not able either. but i can telnet 443 to it.

Re: I cannot login VPN "site is not responding" Issues

JordanHsu — Thu, 07 Sep 2023 01:18:27 GMT

Hello PhoneBoy

Thanks i will try it.