topic Remote client is not reachable from local LAN in SASE and Remote Access

Remote client is not reachable from local LAN

Massimiliano — Thu, 12 Oct 2023 15:09:26 GMT

Hi, we have a issue to reach the PC in remote vpn from LAN server. The PC is able to reach the server, but if the server start a connection on destination port tcp 2701, we saw the traffic went out of the FW, but the connection failed (timeout) and not packet are capture from wireshark.

I suspect a problem on remote vpn client checkpoint (with nat and port translation).

Could you help me to solve this issue?

Best Regards

Massimiliano

Re: Remote client is not reachable from local LAN

PhoneBoy — Thu, 12 Oct 2023 17:13:36 GMT

Have you enabled this option in Global Properties?

Re: Remote client is not reachable from local LAN

Massimiliano — Fri, 13 Oct 2023 08:14:08 GMT

Hi,

we have the properties configured as reported below

Re: Remote client is not reachable from local LAN

PhoneBoy — Fri, 13 Oct 2023 15:14:17 GMT

What’s the version/JHF?
What precisely did you see?
The actual tcpdump/fw monitor output might help.
Did you check with fw ctl debug to see if the traffic got dropped?

Re: Remote client is not reachable from local LAN

Massimiliano — Fri, 13 Oct 2023 15:52:04 GMT

The version is R81 take 74. We did a tcpdump on FW and we saw the packet.

We also configure Remote Desktop rule as reported below.

Re: Remote client is not reachable from local LAN

PhoneBoy — Fri, 13 Oct 2023 20:00:37 GMT

This is for the policy on the client.
What about the Access Policy on the gateway: is there an explicit rule that allows the communication?

tcpdump will only tell you that the packet was received by the gateway, it won't tell you where the traffic goes once it gets there.
fw monitor should tell you where the traffic "disappears" to (note the in/out of the various chains), which should aid in further troubleshooting.

Re: Remote client is not reachable from local LAN

Massimiliano — Tue, 17 Oct 2023 13:51:53 GMT

We found a issue on remote PC. Now the connectivity is okay.

Thanks for your suggestions.

Regards