topic Re: domain-udp Decrypted in community RemoteAccess in SASE and Remote Access

domain-udp Decrypted in community RemoteAccess

WhOPP — Tue, 30 May 2023 17:39:16 GMT

Hi,

we have about 100 VPN users. Some use CP mobile, some SecureRemote.

Only one user have some problem. On his site, he doesn't have any problems. But in log file, there is record every 20-40sec. Copy is down below.

I did try to fresh install client and also tries his credentials on new PC, but problem remains.

Why is his computer try to connect to DC every few seconds? He only use VPN for RDP, but even if he only establishes VPN without RDP connection, logs are full with same message as copy of log bellow.

Did try with win10 and win11. All other users doesn't create logs like one bellow

Interface Direction: inbound

Id Generated By Indexer: false
First: true
Sequencenum: 1
Source Zone: External
Destination Zone: Internal
Service ID: domain-udp
Source: 10.18.252.27
Source Port: 58782
Destination: 10.18.205.35
Destination Port: 53
IP Protocol: 17
Scheme: IKE
Methods: ESP: 3DES + SHA1
VPN Peer Gateway: 10.18.252.27
Community: RemoteAccess
VPN Feature: VPN
Action: Decrypt
Type: Connection
Blade: VPN
Service: UDP/53
Product Family: Access
Logid: 0
Access Rule Name: VPN Support
Description: Decrypted in community RemoteAccess

Re: domain-udp Decrypted in community RemoteAccess

the_rock — Tue, 30 May 2023 17:47:47 GMT

If I were you, since you say its just 1 single user, I would maybe have them delete/re-create VPN site, if that fails, have them reinstall the vpn client (maybe try latest one, E87.30)

Cheers,

Andy

Re: domain-udp Decrypted in community RemoteAccess

WhOPP — Tue, 30 May 2023 18:09:24 GMT

Hi, thanks for replay

I did delete user and create new one with new certificate. Also reinstalled client on his PC and also try with new clean VM but results are same.

All users use same client

https://supportcenter.checkpoint.com/supportcenter/portal/user/anon/page/default.psml/media-type/html?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=118725

FW is R81.10

Re: domain-udp Decrypted in community RemoteAccess

the_rock — Wed, 31 May 2023 01:21:37 GMT

Maybe try newest VPN client to see if it makes any difference. Only other reason I can think of would be maybe some 3rd party software possibly causing this. Other than that, maybe engage TAC, but not real sure how much they can do either, considering its definitely not the FW issue.

Andy

Re: domain-udp Decrypted in community RemoteAccess

_Val_ — Wed, 31 May 2023 08:21:45 GMT

The client is dowing DNS requests. I guess it is perfectly normal.