topic Re: Loss of Administrator Access to Branch Firewall's Public IP while VPN tunnel is up in Spark Firewall (SMB)

Loss of Administrator Access to Branch Firewall's Public IP while VPN tunnel is up

Hsanity — Wed, 01 Nov 2023 18:20:09 GMT

I've set up the branch site firewall (1450 | R77.20.87 | 990173120 | 990173120) to allow access to its public IP ("x.y.z.a:4434") from the HQ network (m.n.o.p/29). So, access to the branch site firewall over the internet from specific public IPs. This setting works without any issue until a VPN tunnel is established between these two firewalls. After the tunnel is established, I lose admin access to the branch firewall's public IP from the HQ network. HQ firewall is 1570 | R81.10.07 | 996001457. Few notes:

Encryption domains on both sides do not contain their public IPs or any public IPs
When I look at the log on the branch site, I can see the VPN blade is blocking the local_WebUI service from HQ's server IP. Screenshot attached.

Re: Loss of Administrator Access to Branch Firewall's Public IP while VPN tunnel is up

PhoneBoy — Wed, 01 Nov 2023 18:36:27 GMT

Even if your encryption domain does not include the external IP of the gateway, it is always included.
Scenario 3 here: https://support.checkpoint.com/results/sk/sk108600

If your gateway is locally managed, you can make the changes in $FWDIR/lib on the local gateway to exclude the gateway's public IP.
For the changes to take effect after editing the file, either use the CLI command fw_configload or reboot the gateway.

Re: Loss of Administrator Access to Branch Firewall's Public IP while VPN tunnel is up

Hsanity — Wed, 01 Nov 2023 19:45:20 GMT

Thank you @PhoneBoy! But there are a crazy amount of .def files inside "/opt/fw1/lib/". Which .def file am I editing? It would also be awesome if you could mention the line/s to edit on the file.

Re: Loss of Administrator Access to Branch Firewall's Public IP while VPN tunnel is up

PhoneBoy — Wed, 01 Nov 2023 19:54:19 GMT

The SK I linked tells you what file to edit (crypt.def) as well as exactly what edits to make.
Line numbers are dependent on release as well as other changes you may have made.
Note these manual changes will have to be re-applied if you upgrade your firmware.

However, before you do that, you may want to see if this setting is available in R77.20.87 (which will do the same thing):

Re: Loss of Administrator Access to Branch Firewall's Public IP while VPN tunnel is up

Hsanity — Wed, 01 Nov 2023 20:28:26 GMT

I used the webUI advanced settings as it was available. I changed the value to true on both sides. But it didn't help. Ran fw_configload as well as rebooted the branch site fw.

Re: Loss of Administrator Access to Branch Firewall's Public IP while VPN tunnel is up

PhoneBoy — Wed, 01 Nov 2023 20:57:55 GMT

Curious, do you see the traffic on the WAN interface with a tcpdump?

Re: Loss of Administrator Access to Branch Firewall's Public IP while VPN tunnel is up

Hsanity — Fri, 03 Nov 2023 08:14:00 GMT

Generated a tcp dump on the HQ fw.

Command used: tcpdump -i any -nn -vvv -s0 -w /opt/fw1/tmp/email_tmp/tcp_dump.pcap host <HQ public IP> or host <Branch public IP> and port 4434

Re: Loss of Administrator Access to Branch Firewall's Public IP while VPN tunnel is up

PhoneBoy — Fri, 03 Nov 2023 18:58:36 GMT

It's not going through the VPN, which is what I was checking for.
The retransmissions are concerning, definitely recommend getting the TAC involved here: https://help.checkpoint.com