topic Re: Error when creating Access Role in SASE and Remote Access

Error when creating Access Role

Matlu — Mon, 05 Jun 2023 16:36:42 GMT

Hello everyone.

I currently have a ClusterXL R81.10, on which I want to implement a security rule, for a group of remote VPN users.
I think I understand that this works by putting the group object in an Access Role (and I have done so), but the problem is that when installing policies, I get an error, for not having activated the Identity Awaraness blade.

Is it mandatory to activate the blade, to work the Access Role?

There is no other way to work the local users that I have created in the Firewall, to give permissions to remote VPN user connections?

Greetings.

Re: Error when creating Access Role

PhoneBoy — Mon, 05 Jun 2023 17:20:28 GMT

Identity Awareness is required to use Access Roles, yes.
The only other way to do it is to use Legacy User Access rules, but these are only supported in "Firewall only" layers per: https://support.checkpoint.com/results/sk/sk169493

Re: Error when creating Access Role

the_rock — Mon, 05 Jun 2023 17:22:16 GMT

Yes, what @PhoneBoy said is correct, because TAC told me the same in the past. If you do not want to enable IA blade, sk is the only other way to do this.

Andy

Re: Error when creating Access Role

Matlu — Mon, 05 Jun 2023 17:37:40 GMT

Hello,

Thank you for your reply.

I have created a security rule, calling in the origin to a legacy object, for the connection of a remote VPN user, but it is not allowing me the connection, and it shows me the following error message.

Any idea why I get this error message and how to correct it?

The locally created group object is already inside the VPN Community, Remote Access.

Cheers.

Re: Error when creating Access Role

the_rock — Mon, 05 Jun 2023 17:48:02 GMT

Thats probably auth method issue on the gateway object properties.

Andy

Re: Error when creating Access Role

PhoneBoy — Mon, 05 Jun 2023 18:09:20 GMT

Your rule is a "Legacy User Access" style.
As far as I know, this method only allows for a single authentication method.
This log implies you have more than one configured.

Try it with a properly configured Access Role and see if you get the same issue.

Re: Error when creating Access Role

Matlu — Mon, 05 Jun 2023 18:13:59 GMT

Sure, I could try it, but this demands that I activate the AI blade, right?

Re: Error when creating Access Role

PhoneBoy — Mon, 05 Jun 2023 18:27:06 GMT

Yes, as stated previously.

Re: Error when creating Access Role

the_rock — Mon, 05 Jun 2023 18:48:26 GMT

For creating IA access roles, yes buddy.

Andy