topic Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100) in SASE and Remote Access

Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

mbesen — Mon, 15 Jul 2024 09:26:20 GMT

Hello,

I tried to install Remote Access VPN, latest available version (E88.40) on laptop running Windows 11 Enterprise 24H2, build 26100.

Build 26100 is an upcoming 24H2 release that is already available for couple of months in Insider programme, and is released for general availability for ARM computers, with imminent release to Pro and Enterprise SKUs.

So, after installing 24H2 on company laptop and setting up Remote Access VPN, said VPN connects to VPN gateway server for couple of seconds and then it disconnects. Laptop's network adapter stops working too unless I reset it via Settings app.

I know there is no official support for 24H2 yet from Checkpoint, but usually there was installation block that prevented installing Remote Access VPN on unsupported build versions. This time this didn't happen so I wanted to know is CheckPoint aware of this issue, and if needed, I can provide additional logs to help narrow down the root cause test fix, if possible.

Thank you, and kind regards,

Mario

EDIT: I couldn't find Remote Access VPN subforum, didn't notice it's under Quantum now, so if you could be kind enough to move it there I'd appreciate it!

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

Chris_Atkinson — Mon, 15 Jul 2024 10:05:45 GMT

Per sk117536 (Client OS support) we aim to offer early availability clients within 3 weeks of OS GA and to announce GA within 2 months of OS GA, however generally this occurs sooner. See also sk115192 for OS support timeline.

Please otherwise engage with TAC and your SE on this issue if it is a non-ARM environment.
Note ARM support is currently limited to select client types only per sk170777.

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

mbesen — Mon, 21 Oct 2024 15:26:33 GMT

Hi Chris,

thanks for your update, I see this didn't get fixed even with latest Remote Access VPN version so I'll wait for official fix to get out.

Kind regards,

Mario

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

Chris_Atkinson — Tue, 22 Oct 2024 01:39:11 GMT

E88.41 and above introduced EA support for Win1 11 24H2 to my knowledge, for reference latest version is E88.60

For ARM based systems please consult with your local office.

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

the_rock — Tue, 22 Oct 2024 01:45:25 GMT

Thats right. Here is the official sk about it. We actually have a case with TAC T3 about it.

Andy

https://support.checkpoint.com/results/sk/sk182749

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

mbesen — Tue, 22 Oct 2024 08:52:54 GMT

Thank you all!

This is x86, not ARM, and I see that the case is already opened and we are hit with it too.

Kind regards,

Mario

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

G_W_Albrecht — Tue, 22 Oct 2024 09:39:20 GMT

Did you try https://support.checkpoint.com/results/sk/sk182749 yet ?

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

mbesen — Tue, 22 Oct 2024 09:40:36 GMT

Hi,

yeah, I tried applying this on client and it didn't help sadly.

KR,

Mario

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

Chris_Atkinson — Tue, 22 Oct 2024 10:46:46 GMT

Please open a case with support or in case it is already open then please share the SR number in private.

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

the_rock — Tue, 22 Oct 2024 11:44:57 GMT

So you tried modifying trac.defaults on the client as indicated on the bottom of the sk and that did not work?

Andy

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

mbesen — Tue, 22 Oct 2024 12:15:31 GMT

Yep, edited trac.defaults, confirmed it was saved, restarted Remote Access VPN service, and it still didn't work.

I have reverted back to 23H2, and will wait for network team to apply this workaround server-side so we can evaluate this. Thanks!

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

the_rock — Tue, 22 Oct 2024 12:30:27 GMT

Im going to mention this to TAC as well through the case itself...just for the context, what client version?

Andy

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

mbesen — Tue, 22 Oct 2024 12:32:46 GMT

I tried doing this on E88.60, E88.50, and E88.41 (clients that ought to be compatible with 24H2).

KR,
Mario

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

the_rock — Tue, 22 Oct 2024 12:35:13 GMT

Yup, all mentioned in the sk, from E88.40-E88.70. Ironically enough, we even made change on the gateway first, installed policy and it made situation WORSE. Man, none of this is good, it will affect lots of people...

Andy

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

the_rock — Tue, 22 Oct 2024 18:49:46 GMT

Just to update, we had TAC send us updated ttm file for the gw (check the bottom section) and once we pushed the policy, seems that fixed the problem.

You may want to run this once you modify it -> vpn check_ttm $FWDIR/conf/trac_client_1.ttm

If it gives an error, run -> dos2unix trac_client_1.ttm and then vpn command again

Install policy -> test

If cluster, make sure you modify file on both members.

Andy

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

the_rock — Tue, 22 Oct 2024 18:51:23 GMT

@mbesen

Below is what you should see if modification is right.

Andy

[Expert@R82:0]# vpn check_ttm /opt/CPsuite-R82/fw1/conf/trac_client_1.ttm

Summary for the file: trac_client_1.ttm
result: the file passed the check without any problems

[Expert@R82:0]#

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

Lau — Mon, 28 Oct 2024 16:28:50 GMT

https://support.checkpoint.com/results/sk/sk182749 solved the issue partially for me. Thanks!

Does anyone have any idea if this is solvable in a similar way for clients using SNX in network mode? They are experiencing the same symptoms but the solution did nothing as I'm guessing trac_client_1.ttm does not affect that client type.

/Lau

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

the_rock — Mon, 28 Oct 2024 16:48:24 GMT

Thats right, does not affect snx. Maybe check with TAC if there is another modification needed?

Andy

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

Lau — Tue, 29 Oct 2024 08:21:43 GMT

Already have a case with TAC and working through the normal steps. Was hoping someone had already found a solution for a quick fix.

/Lau

Re: Checkpoint Remote Access VPN - support for Windows 11 24H2 (build 26100)

the_rock — Tue, 29 Oct 2024 10:29:05 GMT

Lets see if someone may know.

Andy