Enable any port on Register to Hotspot (SmartEndpoint or Global Properties)

[Hrvoje_Brlek]

Hi,

We are using Endpoint Security clients from E80.87 to E82.10, on approximately 1000 users. Our firewall gateway is on version R80.30, and our Endpoint Security Management Server is also on R80.30 (with two external Endpoint Policy Servers). As we have a lot of roaming users we need the ability to use the Register to Hotspot functionality with all ports open during the registration.

I followed the sk41586 and defined the any_port through GuiDBedit tool, and applied it on the Global Properties (see attachment below) on the firewall gateway.

But, as we are using the SmartEndpoint console, there is also the ability to define the ports to be used for Hotspot registration (Policy -> Allow hotspot registration). How can I define the any_port through SmartEndpoint, what value do I have to use (see attachment below)? There is no description in the admin guide what to use for any port if you define it through SmartEndpoint.

And the thing that confuses me the most. What configuration will be applied on the client side when connected to VPN, the one defined on the gateway in Global Properties or the one defined in the SmartEndpoint Policy?

Below is the configuration I get in trac.config when I connect to the VPN:

<PARAM fw_hotspot_ports="&lt;any_port>"></PARAM>
<PARAM fw_hotspot_ports="443"></PARAM>
<PARAM fw_hotspot_ports="80"></PARAM>
<PARAM fw_hotspot_ports="8080"></PARAM>
<PARAM fw_hotspot_ports="8080"></PARAM>
<PARAM fw_hotspot_ports="8444"></PARAM>

Thanks,

Hrvoje

[PhoneBoy]

Maybe try a port range 1-65535?

[Hrvoje_Brlek]

Already tried, it doesn't accept any kind of port range:

There is also sk155072 which states the format above should work, but it doesn't (I tried while we were on R70.30.03 and now on R80.30):

[PhoneBoy]

If the SK says it should work and it doesn’t…probably worth a TAC case to clarify.

[PhoneBoy]

Checked with R&D, this is most definitely a GUI bug.
Please open a TAC case.

[Hrvoje_Brlek]

OK, thanks, will do so 🙂

[Daniel_Hainich]

hi
any news about this issue? i have the same problem that i cannot configure an port-range.
next question is - do i have to configure global properties and/or hotspot-policy in endpoint-console?

[PhoneBoy]

This should be fixed in R80.40.
Haven't heard of they've backported this in earlier releases, but a TAC case is the way to find out.

[Hrvoje_Brlek · Accepted solution]

1.) The port-range doesn't work, as PhoneBoy mentioned it should be fixed in R80.40.

For us the solution was to use any port. To get it working you need to add any in the SmartEndpoint policy on the Hotspot Settings (Policy -> Allow hotspot registration). I have tested this solution and it is working fine. 

Although, if you check the trac.config file on the client side, the ports that are configured for the hotspot are the ones that are defined in the Global Properties on the gateway (not the ones from SmartEndpoint). But, apparently they are not applied, the configuration from the SmartEndpoint is the one that is applied (in our case any port). 

trac.config:

<PARAM fw_hotspot_ports="22"></PARAM>
<PARAM fw_hotspot_ports="443"></PARAM>
<PARAM fw_hotspot_ports="80"></PARAM>
<PARAM fw_hotspot_ports="8080"></PARAM> 

2.) Also, to answer the second question. It is enough to define the hotspot policy in the SmartEndpoint console.  You can have the option on the Global Properties checked or unchecked, it won't make any difference as long as you are using SmartEndpoint. I tested it both ways, and SmartEndpoint configuration overrides the Global Properties.

In fact, we got the response from TAC regarding this second question and they said it depends if you enforce the Endpoint Firewall policy or the Desktop Policy from SmartConsole (as per sk105644). But, I have tried both options and they don't affect the hotspot registration settings. For us it always remained the one configured in the SmartEndpoint (testing was conducted with re-creating the VPN sites).

[Daniel_Hainich]

thanks for reply. i will test it shortly.

edit: i have tested this solution and it works. hotspot-registration is working now with any port. 🙂

[514numbers]

Off topic, but on the global properties, remote access, hotspot / wifi registration section, where have you found the LOG for tracking? I thought it would be automatically sent up to the management server however unable to find it in the LOGS. Does anybody know where this LOG tracking entry is?