Full endpoint client vpn transport method

Sam2 — Mon, 18 Jul 2022 20:14:26 GMT

Hi Team,

I am currently facing an issue with a specific Citrix application that does not launch correctly from the Endpoint VPN, it instead displays a black screen and nothing loads.

Through the troubleshooting we have done we found that if the user connects off of their home network, for example by tethering to the cell network, or going to Starbucks, the application will launch without issues. My current workaround for the problem users is to use the SNX to connect which works great but is not our preferred VPN solution.

My assumption is that the users ISP (this is a global problem for a very small group of people who use this application) is in some way playing with their IPSec traffic and it's preventing the application from loading correctly.

Is there a way I can locally force these endpoint clients through a modification of some trac file to use visitor mode instead of IPSEC? Has anyone faced an issue like this before? Currently, the only two workarounds that have produced results are either swapping ISPs to another or using SNX.

Re: Full endpoint client vpn transport method

PhoneBoy — Fri, 22 Jul 2022 21:17:16 GMT

You can force all clients to use Visitor Mode by the following: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk107433
However, that's probably not what you want.

I believe you may be able to adjust this on the client configuration, at least based on what I see in Trac.defaults.
That means:

Unobscuring trac.config on the client: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk55120
Making the relevant change in the configuration, which I believe is changing the Transport more from Auto-Detect to Visitor-Mode

The TAC may know of a better way to achieve this.

topic Re: Full endpoint client vpn transport method in SASE and Remote Access

Full endpoint client vpn transport method

Re: Full endpoint client vpn transport method