topic Remote Access VPN Users Unable to Connect to Location 2 Servers. in Spark Firewall (SMB)

Remote Access VPN Users Unable to Connect to Location 2 Servers.

kristait — Sat, 08 Jun 2024 13:11:11 GMT

Dear Checkpoint Community,

I am experiencing an issue with our VPN setup and would appreciate your assistance. The network topology is as follows:

Location 1:
- Checkpoint 1800 SMB
- Local Users
- Local Servers
Location 2:
- TP-Link Router
- Local Servers

There is a site-to-site VPN established between Location 1 and Location 2, allowing seamless connectivity between the servers and users in these locations.

Issue: Users in Location 1 and the servers in Location 1 can successfully ping/connect to the servers in Location 2 through the site-to-site VPN. However, remote access (RA) VPN users connecting to the Checkpoint firewall at Location 1 are unable to connect to the servers in Location 2.

Steps Taken:

Verified the RA VPN configuration and connectivity to Location 1 resources.
Confirmed the site-to-site VPN is operational and allows traffic between Location 1 and Location 2 servers.
Checked the firewall rules to ensure there are no blocks on traffic from RA VPN users to Location 2 servers.

Despite these steps, RA VPN users still cannot access Location 2 servers. I suspect there might be an issue with the routing or access rules specific to RA VPN users.

Questions:

Are there any specific settings required in the Checkpoint 1800 SMB to enable RA VPN users to access resources over a site-to-site VPN?
What additional configurations or troubleshooting steps should I consider to resolve this issue?

Any guidance or suggestions would be greatly appreciated. Thank you in advance for your help!

Re: Remote Access VPN Users Unable to Connect to Location 2 Servers.

the_rock — Sat, 08 Jun 2024 14:10:14 GMT

I would say as long as vpn domains and rules are good, you should be fine. As far as troubleshooting, I would confirm the logs first, then maybe do some basic vpn checks, ie does it fail on phase 1 or 2? What do they see on the other side?

Andy

Re: Remote Access VPN Users Unable to Connect to Location 2 Servers.

kristait — Sat, 08 Jun 2024 15:13:39 GMT

Hello @the_rock , Thank you for the response. please find attached logs screenshot for your reference.

Re: Remote Access VPN Users Unable to Connect to Location 2 Servers.

the_rock — Sat, 08 Jun 2024 15:21:00 GMT

Do you see any dropped logs about it? Based on what you sent, I cant really "decipher" why this fails.

Andy

Re: Remote Access VPN Users Unable to Connect to Location 2 Servers.

kristait — Sat, 08 Jun 2024 15:34:04 GMT

Not able to see any dropped logs when I try to ping from RA User to location 2 servers, attached the screenshot.

Re: Remote Access VPN Users Unable to Connect to Location 2 Servers.

the_rock — Sat, 08 Jun 2024 15:31:53 GMT

Might be worth TAC case to check further, sorry, I dont work often with SMB : - (

Re: Remote Access VPN Users Unable to Connect to Location 2 Servers.

kristait — Sat, 08 Jun 2024 15:41:52 GMT

The case is already open with the support team (SR Number: 6-0003950608) and has been for a few weeks, but they have not been able to assign an engineer yet.

Re: Remote Access VPN Users Unable to Connect to Location 2 Servers.

PhoneBoy — Mon, 10 Jun 2024 14:41:10 GMT

Did you set the Remote Access Encryption Domain to include Location 2's resources?
This is done in VPN > Remote Access > Advanced
Click on the link in the sentence Local encryption domain is defined automatically according to topology...
Users will need to re-add the site to their client after this.

Re: Remote Access VPN Users Unable to Connect to Location 2 Servers.

kristait — Wed, 12 Jun 2024 02:16:48 GMT

Hello @PhoneBoy,

I have added Location 2's resources to the Local encryption domain, but Remote Access users are still unable to access these resources. Please refer to the attached screenshot of the configuration and logs. As you can see, there are no drops.

Re: Remote Access VPN Users Unable to Connect to Location 2 Servers.

PhoneBoy — Wed, 12 Jun 2024 02:39:39 GMT

Did the users delete and re-add the site on their end?
If so and this persists, you may need the TAC to investigate: https://help.checkpoint.com

Re: Remote Access VPN Users Unable to Connect to Location 2 Servers.

kristait — Wed, 12 Jun 2024 02:45:31 GMT

Hello @PhoneBoy, yes, while troubleshooting, I deleted the site and reconfigured it from both ends, but the issue still persists. I have also raised a TAC case (Case #: 6-0003950608), but they have not provided a proper solution.

Re: Remote Access VPN Users Unable to Connect to Location 2 Servers.

the_rock — Wed, 12 Jun 2024 02:46:49 GMT

Keep us posted how it goes with TAC.

Andy

Re: Remote Access VPN Users Unable to Connect to Location 2 Servers.

kristait — Tue, 06 Aug 2024 15:35:44 GMT

Sorry to say, but we are opting to use a third-party service for our VPN needs, as TAC has been unable to resolve the issue. We hope that the R82 firmware for SMB locally managed devices will address this issue.

Does anyone know when the R82 firmware for SMB firewalls will be released?

Re: Remote Access VPN Users Unable to Connect to Location 2 Servers.

PhoneBoy — Mon, 12 Aug 2024 17:02:51 GMT

R82 for SMB is most likely next year (note R82 is not GA for regular Quantum Appliances yet).

SAML Support (something you mentioned in your SR) is actually planned for R81.10.15, which is currently in EA.
It's also not clear from the SR if you included the networks behind the TP-Link router in your Remote Access Encryption Domain.
This needs to be configured correctly for this to work.
Additionally, make sure the TP-Link knows to route the Office Mode addresses back to you (these are the IPs the clients will receive on connection).