topic keepalive on Endpoint Security in SASE and Remote Access

keepalive on Endpoint Security

Daniel_Kavan — Fri, 09 Aug 2024 20:58:53 GMT

The user upgraded to E88.50 and we are still seeing the issue. ICMP pings from his PC or router to the gateway. Is there some kind of keepalive ping check on Endpoint Security I can have him uncheck? We are trying to figure out what's sending pings back to the remote access gateway (which are dropped) dest-unreach (ICMP). We don't allow ping.

Re: keepalive on Endpoint Security

the_rock — Sat, 10 Aug 2024 00:38:41 GMT

Yes, there is and it actually has absolutely zero to do with endpoint version. Its in global properties and its refered to below.

Hope that helps.

Best,

Andy

http://downloads.checkpoint.com/dc/download.htm?ID=60345

To configure tunnel idleness:

1. Connect to the Security Management Server with GuiDBedit.

2. Open the Global Properties > properties > firewall_properties object.

3. Find disconnect_on_idle and these parameters:

• do_not_check_idleness_on_icmp_packets

• do_not_check_idleness_on_these_services - Enter the port numbers for the services that you want to ignore when idleness is checked.

• enable_disconnect_on_idle - to enable the feature

• idle_timeout_in_minutes

4. Save and install the policy.

Btw, there is ping option there you can change, so if user is somewhat savvy, they can always keep pinging say google dns in cmd and tunnel will NEVER time out, though its supposed to say after 60 mins (just as an example)

Re: keepalive on Endpoint Security

Daniel_Kavan — Mon, 12 Aug 2024 13:30:33 GMT

Thanks, that 60345 link isn't opening for me. I'm looking for something to change on the client side actually. Is there a tunnel keep alive check box for example?

Re: keepalive on Endpoint Security

the_rock — Mon, 12 Aug 2024 13:42:43 GMT

There is enable always connect, but in order for client to be able to check that, it has to be enabled in global properties, under endpoint options. Except in your case, it should say always connected.

Andy

Re: keepalive on Endpoint Security

_Val_ — Mon, 12 Aug 2024 13:56:21 GMT

It is just RAS VPN Admin guide, you can look it up as HTML page under support.checkpoint.com

Re: keepalive on Endpoint Security

the_rock — Mon, 12 Aug 2024 14:25:00 GMT

@Daniel_Kavan Glad we can help mate. If anything else, just update the thread.

Andy