topic SSL error- failde to connect in SASE and Remote Access

SSL error- failde to connect

junior_kakou — Wed, 02 Oct 2024 09:44:42 GMT

hello everyone;

i'm getting the SSL error failed to connect with capsul-vpn. i have a CP 3600 behind a mikrotik router, i've created a NAT rule to redirect port 10.10.11.2:443 (public ip) on the microtik to port 10.10.10.1:443 (ip LAN) on the CP. When the destination address (10.10.11.2) is specified in the microtik's NAT rule, some web pages are not displayed and the remote VPN passes normally. But when it is not specified, the web pages are displayed but the remote VPN no longer works. Do you have any ideas? I'm thinking of a conflict on the port, but how can I resolve it?

Thanks

Re: SSL error- failde to connect

AkosBakos — Wed, 02 Oct 2024 09:55:17 GMT

What kind of NAT did you use?

Akos

Re: SSL error- failde to connect

junior_kakou — Wed, 02 Oct 2024 11:53:37 GMT

static NAT

Static NAT

Re: SSL error- failde to connect

the_rock — Wed, 02 Oct 2024 12:23:14 GMT

Can you select 0 for any protocol or no?

Re: SSL error- failde to connect

PhoneBoy — Wed, 02 Oct 2024 15:41:01 GMT

You need to configure Link Selection in this case (in the Gateway object) to the external IP on the Mikrotik router.

Re: SSL error- failde to connect

junior_kakou — Wed, 02 Oct 2024 15:48:37 GMT

Sorry, I don't understand.

Re: SSL error- failde to connect

the_rock — Wed, 02 Oct 2024 15:54:14 GMT

This is what @PhoneBoy is referring to.

Andy

Re: SSL error- failde to connect

junior_kakou — Wed, 02 Oct 2024 18:50:39 GMT

the solution doesn't work. is it possible to change port 443 to another alternative port on checkpoint and how do I do it? thank you.

Re: SSL error- failde to connect

the_rock — Wed, 02 Oct 2024 20:38:41 GMT

Change port for what?

Andy

Re: SSL error- failde to connect

PhoneBoy — Wed, 02 Oct 2024 20:50:23 GMT

What is the exact behavior?

The way to change the port is by changing the Visitor Mode port, which can only be done if Mobile Access Blade is not used.
This is done in the relevant gateway object under IPsec VPN > Remote Access.
Site must be added to the client with the port number (e.g. 10.10.11.2:8443)

Re: SSL error- failde to connect

junior_kakou — Fri, 04 Oct 2024 11:40:42 GMT

ok merci à tous pour vos éclairages. le problème est résolu après avoir indiqué dans la règle NAT sur le routeur Microtik, l'interface sur laquelle arrive la connexion Wan.