topic Re: Remote Access - desktop_post_connect_script in SASE and Remote Access

Remote Access - desktop_post_connect_script

AkosBakos — Tue, 08 Aug 2023 08:12:56 GMT

Dear All,

I have a demo environment, where I want to the post-login script functionality.

I seemed straightforward according to this article:

https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/Configuring-Post-Connect-Scripts.htm

I used a simple .vbs which would pop up a window with a word. The location is C:\install\test.vbs .

My MGMT and GW is R81.10 take 95

Anybody experienced such kind of behavior?

All answer are welcome 🙂

Akos

Re: Remote Access - desktop_post_connect_script

G_W_Albrecht — Tue, 08 Aug 2023 08:41:49 GMT

Try a .bat file - .vbs will not work afaik... sk103117: How to run the Post Connect Script on a Remote Access VPN client that connects to a specific VPN Gateway

Re: Remote Access - desktop_post_connect_script

AkosBakos — Tue, 08 Aug 2023 08:48:43 GMT

Hi G_W_Albrecht

Same, it seems the values of the trac_client_1.ttm does not take affect on the client side.

If I check the trac.defaults on the client side and the post_connect_script parameters empty, however I set it on the GW side. For test purposes I set the flush_dns_cache to "true" but it didn't make changes on the client side.

flush_dns_cache STRING "false" G W_USER 1 <----- default values

Akos

Re: Remote Access - desktop_post_connect_script

G_W_Albrecht — Tue, 08 Aug 2023 09:07:35 GMT

As shown in https://support.checkpoint.com/results/sk/sk103117 - Did you do a policy install and delete & recreate the site on the client after the changes ?

Re: Remote Access - desktop_post_connect_script

AkosBakos — Tue, 08 Aug 2023 09:07:04 GMT

Hi,

Yes of course.

Akos

Re: Remote Access - desktop_post_connect_script

G_W_Albrecht — Tue, 08 Aug 2023 09:35:34 GMT

I would suggest to contact TAC !

Re: Remote Access - desktop_post_connect_script

AkosBakos — Tue, 08 Aug 2023 09:37:34 GMT

Hi,

That would be the last chance, because it is a test system without any support.....
I don't think they would help me.

Re: Remote Access - desktop_post_connect_script

AkosBakos — Tue, 08 Aug 2023 09:45:33 GMT

One more thing, is this correct syntax?

Re: Remote Access - desktop_post_connect_script

G_W_Albrecht — Tue, 08 Aug 2023 09:47:36 GMT

No - see https://support.checkpoint.com/results/sk/sk103117 -

:default (C:\vpn_pcs.bat)

Re: Remote Access - desktop_post_connect_script

G_W_Albrecht — Tue, 08 Aug 2023 09:48:30 GMT

As long as you are testing for a customer with a valid support contract, it does not matter.

Re: Remote Access - desktop_post_connect_script

AkosBakos — Tue, 08 Aug 2023 10:18:49 GMT

Hi,

Ok, but the file must be in the root (C:\)?

SK said:

  :default (<Full Path to the script file on the Remote Access VPN computer>)

Re: Remote Access - desktop_post_connect_script

G_W_Albrecht — Tue, 08 Aug 2023 10:24:31 GMT

You have to give the full path - regardless if that is C:\<somepath> or D:\<somepath> or F:\<somepath>, it only has to be the same for every client !

Re: Remote Access - desktop_post_connect_script

AkosBakos — Tue, 08 Aug 2023 11:36:59 GMT

One step forward:

trac.log

[ 4524 6448][8 Aug 13:15:25][TR_FLOW_STEP] TrRunScriptsStep::RunCommandLine: SCRunProcessAsUser returned with code 2 - failed to create process
[ 4524 6448][8 Aug 13:15:25][TR_FLOW_STEP] TrRunScriptsStep::RunScriptThread: Failed to run script: 'C:\Users\Public\Documents\vpn_pcs.bat''.

What could be this? 🙂

Re: Remote Access - desktop_post_connect_script

G_W_Albrecht — Tue, 08 Aug 2023 11:50:40 GMT

Can you run the script from CLI with user-level permissions ?

Important Note - The Post-Connect script runs with user-level permissions. For security reasons, running the Post-Connect script is not supported if users do a Secure Domain Login before Windows login.

Re: Remote Access - desktop_post_connect_script

AkosBakos — Tue, 08 Aug 2023 11:58:08 GMT

Hi,

My first idea was the same. I'm able to run the script. My client is a simple win10 client.

Akos

Re: Remote Access - desktop_post_connect_script

G_W_Albrecht — Tue, 08 Aug 2023 12:04:40 GMT

What simple win10 client ? I thought you are using E87.30 RA VPN client ? Neverteless, SCRunProcessAsUser returned with code 2 - failed to create process looks like the client has no rights to run it...

Re: Remote Access - desktop_post_connect_script

AkosBakos — Tue, 08 Aug 2023 12:03:26 GMT

To clarify this?

I'm using a win10 with E87.30 RA VPN client

Re: Remote Access - desktop_post_connect_script

AkosBakos — Mon, 19 Aug 2024 08:55:33 GMT

A late follow-up:

I needed toadd the missing parameters following sk75221.

mod_enabled

Akos