Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Eric_Speake
Contributor
Jump to solution

The users capsule keeps reporting an IP IP Address.

We are seeing that when we have users that go out of the U.S. and when they come back capsule is still reporting the foreign IP address for 5 days. Is there a way to clear this automatically. How can we make it report the actual current IP.  When they come back into the U.S. we get an alert about traffic from a foreign IP.

As an example we have a user that went to Canada. For 5 days after their return the logs shows them connecting from the last IP address is Canada they used.

Thanks,

Eric

1 Solution

Accepted Solutions
Daniel_Dor
Employee Alumnus
Employee Alumnus

Hi Eric,

I think that because of the fact they "open a session" in Canada or Mexico, it remains open even when they get back to the US.

Please run the following steps and let me know if it works:

1. When one of you guys have this issue -> Check the IP he currently gets -> then tell him to enter Capsule Workspace

2. Then sign out of Capsule Workspace

3. Then sign in again using his AD Credentials 

4. Then look at the IP address (if it was changed)

Please let me know what is the issue so we can decide what would be best way to approach this.

D

View solution in original post

7 Replies
PhoneBoy
Admin
Admin

This sounds like a Capsule Cloud question (which runs on laptops) rather than a Capsule Workspace question (runs on mobile devices).

Can you clarify?

Eric_Speake
Contributor

This is on their mobile devices the issue is occurring. We currently are only deploying to mobile devices. Our Capsule users connect to the VPN with laptops to check email.

Thanks,

Eric

Sent securely from my Android

Daniel_Dor
Employee Alumnus
Employee Alumnus

Hi Eric,

The Capsule family has few different products:

1. Capsule Cloud

2. Capsule Docs

3. Capsule Workspace

Could you please describe the architecture you use and the exact product you use so we can better understand the problem?

D

Eric_Speake
Contributor

Daniel,

We use capsule workspace to allow access to email, calendar, and some internal web applications. We use Microsoft exchange for our enterprise mail. We have users that will travel to Canada and Mexico to work with venders and when they return to the U.S. for the next five days when they connect with Capsule Workspace the IP address that is presented from capsule from that device is the IP address from that was used while they were out of the country.

This triggers an alert on our IPD, checkpoint FW as well. We confirm that they have returned to the U.S. and have them to whatismyip.com to confirm the IP address they are getting for the data connection on the phone or tablet. So the IP is being held in some type of cache storage. We need to know if there is a setting or a way to clear that so we are not investigating false positives in out IPS.

Thanks,

Eric Speake

Senior Systems Administrator

Information Technology

O'Reilly Auto Parts

(417) 862-2674 Ext. 1975

Daniel_Dor
Employee Alumnus
Employee Alumnus

Hi Eric,

I think that because of the fact they "open a session" in Canada or Mexico, it remains open even when they get back to the US.

Please run the following steps and let me know if it works:

1. When one of you guys have this issue -> Check the IP he currently gets -> then tell him to enter Capsule Workspace

2. Then sign out of Capsule Workspace

3. Then sign in again using his AD Credentials 

4. Then look at the IP address (if it was changed)

Please let me know what is the issue so we can decide what would be best way to approach this.

D

Eric_Speake
Contributor

Daniel,

We are seeing an authentication that creates a session for 168 hours. Unless there is another authentication it appears to keep the IP address.

Is there a way to shorten that time frame and or make workspace always use the current IP on the device?

Thank you,

Eric

Daniel_Dor
Employee Alumnus
Employee Alumnus

Hi Eric, how are you?

To solve this, please answer the following questions:

1. Are you referring IPs displayed in the SmartView tracker? Do you mean that even when the devices are connected in the US , they displayed as if they are using the same IP they used when they started the VPN Session (i.e. Mexico's IP?)
2. Can you send Snapshots of SmartLog Tracker with an example? (the best way would be to open Sevice Request via Check Point Site)
3. Do you have the same issue when connecting with Capsule Workspace both to Wi-Fi and 3G?
4. Let’s say we sign out in Mexico from the session and re-sign in the US. Does this solve the issue?

Thanks.

D

Upcoming Events

    CheckMates Events