topic Re: Endpoint VPN Internet Access in SASE and Remote Access

Endpoint VPN Internet Access

Craig_Waddingto — Thu, 30 May 2019 01:56:43 GMT

Hoping someone can help me troubleshoot. Endpoint VPN users cannot browse the Internet.

Internal: Works great. Can ping all Internal resources, use Internal websites, resolve DNS internal and external.

Internet: Cannot ping google.com.au, cannot browse to say Google. Tracert to google.com stops at FW/Gateway.

In Gateway logs. VPN:Blade I dont see any drops, everything is accepted.

Any ideas on how to troubleshoot?

Can someone provide a copy of a Rule example for VPN Internet acccess?

Re: Endpoint VPN Internet Access

PhoneBoy — Mon, 03 Jun 2019 03:02:19 GMT

Start with: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101239

Re: Endpoint VPN Internet Access

Craig_Waddingto — Mon, 03 Jun 2019 03:31:55 GMT

Thank you PhoneBoy.

Great article, that helped me a lot to find the issue.

I had to add Nat Translation to the Office Mode address pool and also add a Static route on the Gateway.

It is now working perfectly.

The Checkpoint Documentation to set this up is incomplete and Confusing, makes it a lot harder than it should be. I could do a video of how to set this up in 5 minutes, I spent days trawling through SK's to get the VPN up and running correctly.

I find most of the Documentation obsure and need to look at 20 SK to achieve one thing.

Static Route SK.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk39746

Command I ran with my Network details.

set static-route 192.168.0.0/24 nexthop gateway address 10.0.0.1 priority 1 on

Re: Endpoint VPN Internet Access

PhoneBoy — Mon, 03 Jun 2019 03:43:44 GMT

We are definitely looking for more How-To videos and would welcome your submission.