Restrict users to disconnect from remote access VPN client

[KirillMuravyev]

Hello mates!

We are looking for a solution for remote users to inspect all their Internet traffic while out of a corporate network.

Enabling fulltunnel makes all traffic to be routed through gateway for inspection, but users still able to click "disconnect" in the client.

I know about machine certificate only auth, but we cannot use it as less secure option.

Also, ATM looks not good as well.

I was hoping this can solve my problem:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/C...

section "Location-Based Policies". But I didn't get from the documentation exactly how to set this up, where to configure "connected" and "disconnected" policy.

So ideally the idea is to restrict Internet access for users until they are connected to VPN.

has anyone tried this setup?

[_Val_]

You need to create a rule in the disconnected policy which blocks web access.

[KirillMuravyev]

Hi, can you share where exactly this disconnected policy exists and how to confgiure it?

[G_W_Albrecht]

See https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/C... for all necessary steps!

[KirillMuravyev]

Hi, I know this doc as I shared it in initial message.

This page in guide regarding location-based policy does not specify where exactly should I configure connected/disconnected policy, this is not obvious.

[_Val_]

In that very document, it says (bold markings are mine):

The administrator defines the Desktop Security Policy in the Desktop Rule Base in SmartDashboard. You can assign rules to specified user groups or to all users.

SmartDashboard, Desktop Policy, it is documented.

[_Val_]

Also, in the same document:

Configuring Desktop Security

To enable the Security Gateway to be a Policy Server for Desktop Security:

1. Click Gateways & Servers and double-click the Security Gateway.

   The Security Gateway window opens and shows the General Properties page.

2. On the Network Security tab, select IPsec VPN and Policy Server.

3. Click OK.

4. Publish the changes.

To activate the Desktop Security policy:

1. Click Security Policies and open the Manage Policies window (CTRL + T).

2. Click the All icon.

3. Select the policy to edit and click Edit.

   The policy window opens.

4. Select Desktop Security.

5. Click OK.

6. Install policy.

To configure the Desktop Policy rules:

1. Click Security Policies, and from the navigation tree, click Access Control > Desktop.

2. Click Open Desktop Policy in SmartDashboard.

   SmartDashboard opens and shows the Desktop tab.

3. Configure the inbound rules: Click Rules>Add Rule to add rules to the policy.

   In inbound rules, the client computer (the desktop) is the destination. Select user groups to which the rule applies.

4. Configure the outbound rules. Click Rules>Add Rule to add rules to the policy.

   In outbound rules, the client computer (the desktop) is the source. Select user groups to which the rule applies.

5. Click Save and close SmartDashboard.

6. Install the policy.

   Make sure that you install the Advanced Security policy on the Security Gateways and the Desktop Security policy on your Policy Servers.

[KirillMuravyev]

THanks, but I can read the guide as well and I followed all the steps.

Guide says that we have Connected policy and Disconnected policy.

It is not clear where you configure those 2 different policies?

Below is a screenshot from SmartDashboard, where should I configure Connected policy and Disconnected policy?

[_Val_]

This screenshot does not look right. Which version are you using? The GUI looks like a very old version

[KirillMuravyev]

Screenshot looks right, SMS version is 81.20 take 105.

This is a SmartDashboard for configuring desktop policy, screenshot below shows where you open it

[PhoneBoy]

You don't really configure a specific "disconnected" policy, but it changes the relevant "encrypt" rules to allow.
See here: https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN... 

[KirillMuravyev]

Again, I saw this doc and followed all the steps. If it was clear from the guide how it works I wouldn't create this topic.

The goal is to restrict user's Internet access while not connected to VPN. I was hoping to configure connected/disconnected policy like it is mentioned in the guide, but it is not clear exactly how.

The guide says:

• Connected Policy - Enforced when:

  • VPN is connected.

  • VPN is disconnected and Location Awareness determines that the endpoint computer is on an internal network. The Connected Policy is not enforced "as is" but modified according to the feature's mode (the disconnected_in_house_fw_policy_mode property).

• Disconnected Policy - Enforced when the VPN is not connected and Location Awareness sees that the endpoint computer is not on an internal network.

So, it says that connected policy will be inforced also when VPN is disconnected but modified according to property

Later guide says regarding this property (disconnected_in_house_fw_policy_mode):

Possible values are:

• encrypt_to_allow - Connected policy will be enforced, based on last connected user. Encrypt rules will be transformed to Allow rules (default).

• any_any_allow - "Any - Any - Allow" will be enforced.

So, it is not clear what does it mean "based on last connected user" and "Encrypt rules will be transformed to Allow rules", what user we talking about, what encrypt rules we talking about?

All in all not clear what this feature do exactly

[G_W_Albrecht]

As this is a legacy feature very seldom enabled and used, i would suggest to open SR# with CP TAC to get the procedure to accomplish your goal !

[the_rock]

On way would be if you have IA enabled to set up access role for this. I attached a screenshot.

Andy

[KirillMuravyev]

What is IA?

Can you elaborate please how access role in access rule can help accomplish the goal?

[the_rock]

Identity awareness. I will take video later and upload.

Andy

[the_rock]

@KirillMuravyev 

Attached. Btw, once you have access role configured, you can use it in policy rule to restrict access.

Andy

[KirillMuravyev]

Thanks for video, I do have IA enabled and I understand how to configure the access role.

The question was how this setup will help me restrict remote user's Internet access while not connected to VPN ?

The goal is to force people connect to VPN while they are remote, always-connect feature is on but it still allowes user to click "disconnect" button

[the_rock]

One way it can help is to add type of clients in access role and then use that role to allow or restrict access.

Andy

[KirillMuravyev]

So how to set this policy work only for "disconnected" clients?

[the_rock]

Let me do some tests in the lab later and will verify.

Andy

[KirillMuravyev · Accepted solution]

We have found a solution with support.

There is no way to disable "disconnect" button in the client for users, but you can restrict user's network access while they are disconnected from the VPN.

In order to to that you have to enable desktop security (policy server blade at SG properties). Then you have to configure outbound policies in Smartdashboard.

Important now, policies that you configure for "All users" are being downloaded by the VPN client initially and applies by default when client is disconnected. Any policy that is configured for specific user or ldap group will apply when user is connected to VPN.

So, you configure "All users" policy that restrics Internet access and allows only Public VPN gateway IP (so users can connect to VPN), and allow any any for specific ldap group (I just put group with all VPN users).

Also, look here https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/C...

if you configure network location awareness, so when client considers itself inside corporate network access would be allow any any

[the_rock]

@KirillMuravyev Excellent...thanks for letting us know.

Andy