topic Re: Internal Servers cant access after login the client in SASE and Remote Access

Internal Servers cant access after login the client

yeruel — Sun, 12 Jan 2025 06:24:28 GMT

Hi Checkmates,

I have created tasks that Remote access VPN client users login to the checkpoint VPN client.

VPN users can login to the VPN client and can get the IP pool with DNS.

After login successfully into the VPN client, the can't access the internal servers. Please any help.

1. I have created rule that matches

Source : Access role (Local users, network vpn Pool IP address),

Destination: Local LAN network, servers

RemoteAccess VPN community enabled.

2. OSPF is enabled between CP firewall and internal LAN switch

3. Static routing to external

Re: Internal Servers cant access after login the client

Chris_Atkinson — Sun, 12 Jan 2025 06:46:04 GMT

1. Any drops logs for the traffic flow and what do you see with tcpdump / debugs?

2. What gateway version/JHF and which VPN client version/build?

3. Is it DNS related or does even basic connectivity by IP not work?

Re: Internal Servers cant access after login the client

yeruel — Sun, 12 Jan 2025 07:15:26 GMT

Hi @Chris_Atkinson

The vpn client is R81.20 downloaded https://support.checkpoint.com/results/download/95064
Gateway version is R81.20
Drop with the cleanup rule. It doesn't matches the remote access VPN rule.

The rule name VPN rule

Source: access role (name is VPN-remote-access) which contains network pool for VPN client 192.168.253.0/24, and users - local users)

Destination: Local network and servers

VPN: RemoteAccess

Service : any/ allow

There is ospf routing to the internal network, that's full established.

The issue is after successful login to the VPN client, users can't access internal network.

Do you think my rule match is correct? The source: is that possible to use access role?

Note: the source policy is Unified

Re: Internal Servers cant access after login the client

Chris_Atkinson — Sun, 12 Jan 2025 08:50:01 GMT

Please note E88.x is the current client version, E81.20 is end-of-life

Regarding the access role, do you have identity awareness enabled with the remote access identity source selected?

Re: Internal Servers cant access after login the client

yeruel — Sun, 12 Jan 2025 08:59:11 GMT

Hi @Chris_Atkinson

I will change the VPN client version. and regarding the Identity awarness, yes it has been enabled, and also AD users are login to the Client-less SSLVPN portal for web application access. Every AD users are loggining and accessing the web application servers. The issues is for the client vpn users after login to access internal server. For Clientless, users are accessing the web servers.

Re: Internal Servers cant access after login the client

the_rock — Sun, 12 Jan 2025 21:15:27 GMT

I had that sort of situation happen before with customers and here is BEST way (at least best I found) to make sure if its identity awareness /access role issue. All you do is replace access role as src with say network group, install policy and test. If that works, then you know 100% what is the issue.

Hope that helps.

Andy

Re: Internal Servers cant access after login the client

yeruel — Mon, 13 Jan 2025 03:11:17 GMT

Hi @the_rock

There is new thing, VPN client users with local users after successful connected to VPN, users can access some servers (172.20.10.10, 172.24.2.3 and subnet of 172.24.x.x and 172.20.X.X), but for others 172.17.0.0 and 10.1.0.x network can't access. The policy for VPN rule is the same single rule.

Source: access role, destination: 172.24.x.x, 172.17.x.x, 172.20.x.x and 10.1.0.x), VPN: remote access, service any any.

Why 172.17.x.x, 10.1.0x are not accessible? Can you provide best solution?

Re: Internal Servers cant access after login the client

the_rock — Mon, 13 Jan 2025 04:25:17 GMT

We would need to see why it fails...as @Chris_Atkinson asked in the beginning, any relevant logs indicating the reason?

Andy

Re: Internal Servers cant access after login the client

AkosBakos — Mon, 13 Jan 2025 10:37:05 GMT

Can you send screenshots of the drop and the rule which should handle the traffic?

A screenshot would be great, where we can see a successful login in Identity Awareness.

And what is the IP that is received the client from the gateway when the VPN client connects?

Akos

Re: Internal Servers cant access after login the client

yeruel — Mon, 13 Jan 2025 11:51:44 GMT

Hi @AkosBakos

Attached screenshoot,

1. VPN client users from internet can login using the local users name and connected to the site

2. VPN Pool IP recevied from vpn pool ip 192.168.254.0,

3. Try to access the internal servers from application servers area. Application servers area network is accessiable

4. Server storage and server farm network are not accissiable from vpn client.

5. From Server storage and server farm (10.1.0.0 and 172.17.0.0 to the outside internet 8.8.8.8 is working fine)

Re: Internal Servers cant access after login the client

AkosBakos — Mon, 13 Jan 2025 12:13:18 GMT

Hi,

In Access rule 1, the Remote Access community intentionally not set in the VPN column?

And the most trivial question, but I want to ask: in the VPN-POOL object the subnet mask is configured corretly (or the network)?

Akos

Re: Internal Servers cant access after login the client

AkosBakos — Mon, 13 Jan 2025 12:21:42 GMT

Wait, this is not a simple drop:

"Encryption Failure: according to the policy the packet should not have been decrypted"

Someting is not overlapping?

https://support.checkpoint.com/results/sk/sk64060

Akos

Re: Internal Servers cant access after login the client

yeruel — Mon, 13 Jan 2025 12:22:14 GMT

attached to address your question.

I just tried to add vpn remoteaccess to rule 1, no result.

Re: Internal Servers cant access after login the client

the_rock — Mon, 13 Jan 2025 12:22:52 GMT

I was just about to give that sk as well. To me, that more seems related to S2S vpn.

Andy

Re: Internal Servers cant access after login the client

the_rock — Mon, 13 Jan 2025 12:24:41 GMT

Can you do route print from cmd on client PC (one of them) that does not work and compare it with same command on one that does work?

Andy

Re: Internal Servers cant access after login the client

yeruel — Mon, 13 Jan 2025 12:44:23 GMT

I think that's for site to site VPN, I am not going to do S2S VPN. My scope is Remote access from the internet using vpn client.

Re: Internal Servers cant access after login the client

yeruel — Mon, 13 Jan 2025 12:45:13 GMT

Any one who can assist via virtual meeting, please

Re: Internal Servers cant access after login the client

the_rock — Mon, 13 Jan 2025 12:46:17 GMT

Yea, lets do zoom, message me directly.

Andy

Re: Internal Servers cant access after login the client

AkosBakos — Mon, 13 Jan 2025 13:05:25 GMT

Please update me with the findigs 🙂

Re: Internal Servers cant access after login the client

AkosBakos — Mon, 13 Jan 2025 13:06:34 GMT

Yes, I know, but something can overlap with the Remote Access IP range