topic Desktop Security firewall policy in active state after Endpoint Client disconnected from server in SASE and Remote Access

Desktop Security firewall policy in active state after Endpoint Client disconnected from server

akurtasanov — Wed, 17 Jul 2024 12:50:01 GMT

Good day.

According to R81.20 Remote Access manual created SVC check with additional test desktop security firewall policy (just simple block outgoing traffic to 8.8.8.8).

SCV works perfectly but firewall policy always in active state even when there is no connection to VPN server.

How to enforce Endpoint client to disable firewall in disconnected state? I would not like to allow remote clients to decide for themselves when to turn off the firewall.

I know that Harmony has such functionality, but we use simple SCV.

Re: Desktop Security firewall policy in active state after Endpoint Client disconnected from server

PhoneBoy — Wed, 17 Jul 2024 17:56:32 GMT

You can configure a different policy for connected and disconnected using the Desktop Security features (not as part of SCV).
I don't believe you can disable the firewall entirely, but you can make the policy "any any" if you'd like: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/Desktop-Security.htm

Re: Desktop Security firewall policy in active state after Endpoint Client disconnected from server

akurtasanov — Thu, 18 Jul 2024 07:08:30 GMT

Added next:

:allow_ipv6 (
:gateway (allow_ipv6
:default (false)
)
)
:disconnected_in_house_fw_policy_enabled (
:gateway (disconnected_in_house_fw_policy_enabled
:default (true)
)
)
:disconnected_in_house_fw_policy_mode (
:gateway (disconnected_in_house_fw_policy_mode
:default (any_any_allow)
)
)

Installed policy

Nothing on client. After several tries Any Any Deny in Desktop Security rule still in active state after VPN disconnection.

Re: Desktop Security firewall policy in active state after Endpoint Client disconnected from server

PhoneBoy — Thu, 18 Jul 2024 17:05:07 GMT

Where did you put this configuration exactly?
These look like ttm settings, just want to confirm.

Re: Desktop Security firewall policy in active state after Endpoint Client disconnected from server

akurtasanov — Fri, 19 Jul 2024 02:14:34 GMT

Yes in trac_client_1.ttm.

Re: Desktop Security firewall policy in active state after Endpoint Client disconnected from server

akurtasanov — Fri, 19 Jul 2024 04:26:13 GMT

There are errors in the official documentation:

1) any_any_allow - is wrong. In sk75221 there is no any_any_allow in disconnected_in_house_fw_policy_mode section. Only all_allow instead off any_any_allow

2) Even with enabled right all_allow option "Any - Any - Allow" will not be enforced. Enforced will be first "Any User@Any" with block or allow action.

3) With enabled Location Awareness for desktop firewall is much better to use "Any - Any - Encrypt" default implied rules for inbound and outbound connections + encrypt_to_allow in disconnected_in_house_fw_policy_mode section in ttm file.