topic Re: Check Point "Reconnecting to site" timeout? in SASE and Remote Access

Check Point "Reconnecting to site" timeout?

Joe_Kanaszka — Tue, 20 Feb 2024 21:10:11 GMT

Hey guys -

Running R81.20

Check Point Mobile client E87.x

Is there a way to control how long the Check Point Mobile Client will attempt to reconnect to a site after its network is pulled out?

Currently, if I connect to a site, and then turn off my WiFi, the Check Point client no longer says "Connected" and will just spin saying "Reconnecting to site (my site)".

The only setting I found is in SmartDashboard:

Disconnect idle sessions after is the disconnection time-out if the connection remains idle. The default value is 60 minutes. When users connect via SSL Network Extender, this timeout does not apply.

What does this mean exactly?

I'm looking for the Check Point Mobile client to time out if it can't connect to a network. If the CP client times out, I'm hoping to see if there is an event generated that we can log and audit.

Thanks guys!

Re: Check Point "Reconnecting to site" timeout?

Lesley — Tue, 20 Feb 2024 21:31:34 GMT

I think only these 2 parameters you can change. Turn it off or on. And interval in minutes for each retry

https://support.checkpoint.com/results/sk/sk75221

neo_always_connected

Description: Client should always try to connect when network is detected.

Type Valid values Default value Available from Available on

string true / false true E80 Windows, macOS
neo_always_connected_retry

Description: Time interval in minutes between each trial to connect when always-connect is set to true.

Type Valid values Default value Available from Available on

integer period of time in minutes 1 E80 Windows, macOS

Re: Check Point "Reconnecting to site" timeout?

the_rock — Tue, 20 Feb 2024 22:09:44 GMT

Hey bro,

Yes, the sk Lesley gave is also what I would follow.

Best,

Andy

Re: Check Point "Reconnecting to site" timeout?

Joe_Kanaszka — Wed, 21 Feb 2024 15:53:43 GMT

Good Morning Lesly and thank you!

What does this setting do - I'm still not sure of its purpose:

SmartDashboard:

Disconnect idle sessions after is the disconnection time-out if the connection remains idle. The default value is 60 minutes. When users connect via SSL Network Extender, this timeout does not apply.

Please see screenshot below:

What is considered an idle session?

Thanks again!

Re: Check Point "Reconnecting to site" timeout?

Joe_Kanaszka — Wed, 21 Feb 2024 15:52:35 GMT

Re: Check Point "Reconnecting to site" timeout?

the_rock — Wed, 21 Feb 2024 15:59:20 GMT

Hey brother,

You can confirm 100% via TAC case, but Im 99% sure it does exactly what it would do for endpoint connect for the setting below in guidbedit.

Best,

Andy

Re: Check Point "Reconnecting to site" timeout?

Joe_Kanaszka — Fri, 23 Feb 2024 13:18:36 GMT

Hey Andy - Happy Friday!

Apologies for the late response - I was working on another issue yesterday.

Thank you for the screenshots and explanation above. I still have a question though. What is considered "Idle"? If the user does not touch their mouse - kinda like your "presence" is inactive on the client computer?

Or does "Idle" mean the Check Point Mobile client is not connected to a network and is "idle"?

Re: Check Point "Reconnecting to site" timeout?

the_rock — Fri, 23 Feb 2024 13:32:38 GMT

Happy Friday my friend!

By idle, it simply means people either walk away from their comp (laptop) OR they are on it, but they do NOT connect to anything inside the network via VPN. K, so lets take this example...say person has 1 hour lunch and they decide, I wont go out, take a walk or I dont feel hungry, I will simply sit at my machine and browse the Internet. That alone would be considered "idle", as they are not working on anything inside the network, simply using their ISP to browse the Internet, as I assume you would have split VPN tunnel.

Best,

Andy

Re: Check Point "Reconnecting to site" timeout?

Joe_Kanaszka — Fri, 23 Feb 2024 13:43:59 GMT

OK - I got ya.

So after the default idle timeout, according to my settings of 60 minutes, the VPN session should be disconnected.

This does not work in my environment. We are not configured for split tunnel. All internet activity gets intercepted by our proxy server over the VPN. So the user is always "on NET".

If the user walks away and goes to lunch, sometimes they are away from their computers for more than 60 minutes, but their sessions are not disconnected. I'm guessing this is due to all the background traffic going back and forth between the WFH user and the internal work network.

Am I correct?

Thanks again Andy!

Re: Check Point "Reconnecting to site" timeout?

the_rock — Fri, 23 Feb 2024 13:54:30 GMT

I think that would make sense, yea. Ah, so its a full tunnet, gotcha. You may want to ask TAC if those guidbedit settings I showed you in previous response would apply to mobile access as well or ONLY endpoint connect vpn client.

Best,

Andy

Re: Check Point "Reconnecting to site" timeout?

Joe_Kanaszka — Fri, 23 Feb 2024 14:12:05 GMT

Cool. Thanks again Andy - much appreciated!

Re: Check Point "Reconnecting to site" timeout?

the_rock — Fri, 23 Feb 2024 14:20:05 GMT

For you bro...no...well you know the rest 🤣🤣

Best,

Andy

Type	Valid values	Default value	Available from	Available on
string	true / false	true	E80	Windows, macOS