topic Re: Remote Access with DynDNS in SASE and Remote Access

Remote Access with DynDNS

nemesis — Sun, 23 Aug 2020 09:18:23 GMT

Hello CheckMates,

I'am trying to get Remote Access (Check Point Mobile Windows Client) working with a DynDNS address as destination. The destination Gateway is a OpenServer with R80.30.

Is there any way to get this working, I did not find anything in posts, Documents or SKs.

The VPN connection works till the IP address of the provider changed. After deleting the site in the client and reconfigure it, this also worked again. So the configuration is ok, and also the download of the topology has no affect to the destination.

To get to this point I used SK32229 to configure the Link Selection in GuiDBedit. There is also the possibility to change to DNS settings, which seems not to be supported for a gateway which is participating on RemoteAccess community. In my case this would be exactly the thing I need, but this does not worked, so I don't really understand why this is not supported for Remote Access but obviously for Site2Site VPN.

For me it look like the windows client is the "problem" because the DNS name will always be translated to IP (which is not always the best way).

Is there any way to bring the client to use DNS instead of IP, or something which I can do on Check Point side?

Thanks in advance

Re: Remote Access with DynDNS

PhoneBoy — Sun, 23 Aug 2020 15:22:24 GMT

We do have a solution that uses DNS on the VPN client, but it’s specific to running the gateways as an Azure VMSS at the moment: https://community.checkpoint.com/t5/Remote-Access-VPN/Scalable-Remote-Access-VPN-with-CloudGuard-IaaS-Video-Slides-and/m-p/91643#M3693
This implies there is a client (not the standard one) that allows this because, as you said, the client generally converts the DNS name to an IP address.
Maybe @Shay_Levin ot @Daniel_Goldenst can comment on more specifics about this client.
Wherher it will work in your case is a different matter.

Re: Remote Access with DynDNS

Daniel_Goldenst — Sun, 23 Aug 2020 17:48:01 GMT

The solution that we have developed for CloudGuard IaaS is consist of VPN End Point Client and VMSS GWs configured in Azure - This is a solution designed specifically for CloudGuard IaaS - Details can be found in the link shared by PhoneBoy.

For specific queries of VPN End Point client features and functionality you should contact the VPN End Point tean

Re: Remote Access with DynDNS

PhoneBoy — Mon, 24 Aug 2020 03:11:21 GMT

Or maybe tag @AndreiR 🙂

Re: Remote Access with DynDNS

nemesis — Mon, 24 Aug 2020 11:30:29 GMT

Thanks all for your reply.

I found a soloution which worked at least for Mobile Access for windows. You can configure the behavior of the client within in the trac_client_1.ttm file on the gateway.

Here you can tell the client to use DNS instead of IP, it is documentend in sk103440, i will also test if this will work for capsule connect. A first test was not that good but this could also be a network coverage problem.