MEP still active after disable

[Secret-goblin-5]

Following https://support.checkpoint.com/results/sk/sk78180

I run 

more $FWDIR/conf/trac_client_1.ttm | grep ":automatic_mep_topology (" -A 9

And I get the same results as in the SK

[Expert@FW1:0]# more $FWDIR/conf/trac_client_1.ttm | grep ":automatic_mep_topology (" -A 9
                :automatic_mep_topology (
                        :gateway (
                                :map (
                                        :false (false)
                                        :true (true)
                                        :client_decide (false)
                                )
                                :default (false)
                        )
                )
[Expert@FW1:0]# timed out waiting for input: auto-logout

Now here is the strange thing, when I connect MEP is disabled, I can only choose from the sites.

But someone else in the company, with the same software, can choose from the Gateways.

It always defaults to the wrong gateway as well.

What's going on here?

[simonemantovani]

did you disabled MEP after the user created the VPN site? Because I noticed that sometimes, if the user connect when the MEP is enabled, and then you disable MEP, the Endpoint client ignore the change and you need to delete and recreate the site.

Maybe this is your scenario.

[Secret-goblin-5]

Been caught out by that before!

No, the VPN sites were deleted and re-created, so not that.

[simonemantovani]

Before involving the TAC, you could check this SK (https://support.checkpoint.com/results/sk/sk75221), and in case verify/modify the trac.config on the affected clients

[Secret-goblin-5]

I found the file but it is just hex code for me, nothing I can edit.

And the GUI has very few edit options. The SK also focuses on the file on the gateways rather the end end user machines.

                :ips_of_gws_in_mep (
                        :gateway (
                                :default (client_decide)
                        )
                )

I did fail to put in an IP for the above, so maybe that is the cause. But I still don't know why it effects one user and not me (well, unless it is client side and somewhere in the hex of trac.config)

[PhoneBoy]

You can unobscure trac.config: https://support.checkpoint.com/results/sk/sk55120