topic Re: IP POOL - STATIC IP in General Topics

IP POOL - STATIC IP

Geomix7 — Thu, 07 May 2020 12:49:43 GMT

Do we have the possibility to assign some static IP address from VPN pool (office mode) R80.20 ?

Re: IP POOL - STATIC IP

HeikoAnkenbrand — Thu, 07 May 2020 15:10:09 GMT

Remote Access VPN clients are assigned their static IP addresses configured in $FWDIR/conf/ipassignment.conf file.

Re: IP POOL - STATIC IP

Geomix7 — Fri, 08 May 2020 07:35:54 GMT

Thanks a lot , Do you know that for every user that i will have static IP do i have to create an obkject on FW ?

Re: IP POOL - STATIC IP

Geomix7 — Fri, 08 May 2020 07:57:41 GMT

We have some more questions because it is not clear on the SK . Do we have to create a specific LDAP group fro the login users? Do we have to create an object for each assigned static IP? This questions have been raised from the notes where it mentions "Objects referenced within the ipassignment.conf MUST exist within SmartConsole."

Re: IP POOL - STATIC IP

G_W_Albrecht — Mon, 11 May 2020 08:24:44 GMT

The user has to be present in Dashboard, either as local or LDAP user. The SK gives reference to the following detailed explanations and examples: https://sc1.checkpoint.com/documents/R80.10_andhigher/WebAdminGuides/EN/CP_RemoteAccessVPN_AdminGuide/13857.htm#o14234

Re: IP POOL - STATIC IP

Albert_Wilkes — Wed, 08 Jul 2020 10:35:13 GMT

Fun fact, it seems you can't "reserve" an IP from the OfficeMode pool - at least not in R80.30 JHF 196 and I couldn't find this documented neither in the SK nor in the VPN guide but I asked for the SK to be amended. We found out the hard way, see these vpnd.elg logs:
[vpnd 11166 4092880800]@FW1[6 Jul 16:34:44] registerAssignedIP: registering non-protected IP c0a8f80b to user user2 for 900 seconds in kernel instance 0
[vpnd 11166 4092880800]@FW1[6 Jul 16:34:44] registerAssignedIP: IP c0a8f80b already belongs to user user1. User user2 registration must fail.

CP support confirmed that the assigned IP should be outside the pool.

Re: IP POOL - STATIC IP

Kaloyan_Kirchev — Fri, 21 Aug 2020 11:05:24 GMT

Can we assign IP based on source and based on user?

Or just one.

$Fwdir\conf\user.def keep getting me syntax errors.

Any help? I want to specify just a single source public IP and assign exactly one Office mode IP.

Re: IP POOL - STATIC IP

_Val_ — Tue, 25 Aug 2020 07:39:03 GMT

According to sk30919, you can do that per range.

Re: IP POOL - STATIC IP

Albert_Wilkes — Tue, 25 Aug 2020 15:26:54 GMT

Correction: I mentioned the above based on first hand information from the logs and a chat with support. Fortunately the guys from the SK team are very thorough when working on SK documentation and they imply that this is actually a bug and that using IPs from the pool SHOULD be possible.

Thank you for providing your feedback to SecureKnowledge on sk33422, titled "Office Mode IP and ipassignment.conf file".

Your feedback was:

------------------
Neither of the documentation mentions the fact that the IP used in ipassignment.conf MUST NOT be part of the pool. We found out the hard way, see these logs:
[vpnd 11166 4092880800]@FW1[6 Jul 16:34:44] registerAssignedIP: registering non-protected IP c0a8f80b to user user2 for 900 seconds in kernel instance 0
[vpnd 11166 4092880800]@FW1[6 Jul 16:34:44] registerAssignedIP: IP c0a8f80b already belongs to user user1. User user2 registration must fail.
------------------

After checking with RnD, they verified in the code that upon Policy install, the ipassignment.conf file is parsed and save the specified OMs in a local hash table, and during the negotiations, there is a check if the OM is already in the on_assigned_ips kernel table.

There might be a limitation in the code, however to investigate this we will need the vpnd logs from the time of the issue.

In case the issue will happen again please open a new service request with the logs.