topic Re: Legacy Remote access solution with R80.10 in Firewall and Security Management

Legacy Remote access solution with R80.10

Blason_R — Mon, 07 Jan 2019 17:36:22 GMT

Hi Guys,

Again converting legacy policies to R80.10; here is one more issue would like to discuss. Previously I had legacy user access Remote Access VPN Solution [EPM].

Then edited the policy and ticked the Application Blade.

When tried installing policy it threw an error about legacy user access group which was used for Remote VPN. Hence I created access role and added those groups in the rule.

Now policy installation was successful and even users were getting connected however one issue I faced was even though ports were allowed in the same rule. Traffic was dropping for Office mode client IPs to destination IPs which were present in the rule and it was dropping at the clean up rule.

Any clue why? Then I again reverted the changes and it started working fine.

Rule#56

Source - RDPusers@Any

Dest - RDP_10.10.10.10

Service - TCP_3389

Action - Accept

Rule#80

Any
Any

Drop

So traffic was dropping at Rule#80 when Rule#56 was converted to

Source - Access_Role_RDPUsers

Dest - RDP_10.10.10.10

Service - TCP_3389

Action - Accept

Re: Legacy Remote access solution with R80.10

Vladimir — Mon, 07 Jan 2019 18:57:43 GMT

If you had a VPN community in the rule with access roles, this may have caused the drops, provided you were using "Unified Access Policy".

Re: Legacy Remote access solution with R80.10

Blason_R — Tue, 08 Jan 2019 01:41:21 GMT

That is applicable to end point VPN as well? Or only for mobile access policy? Yes I have community in the rule base.

What should be done in that case?

Re: Legacy Remote access solution with R80.10

Vladimir — Tue, 08 Jan 2019 04:57:41 GMT

My understanding is that "Mobile Access Policy" is covering all remote access means and is run either in Legacy or Inline modes.

This is the example of the policy I was using in one of my labs with Mobile Access layer:

With Access Roles configured according to your client of preference and the VPN column set to Any.