MEP still active after disable

[Secret-goblin-5]

Following https://support.checkpoint.com/results/sk/sk78180

I run 

more $FWDIR/conf/trac_client_1.ttm | grep ":automatic_mep_topology (" -A 9

And I get the same results as in the SK

[Expert@FW1:0]# more $FWDIR/conf/trac_client_1.ttm | grep ":automatic_mep_topology (" -A 9
                :automatic_mep_topology (
                        :gateway (
                                :map (
                                        :false (false)
                                        :true (true)
                                        :client_decide (false)
                                )
                                :default (false)
                        )
                )
[Expert@FW1:0]# timed out waiting for input: auto-logout

Now here is the strange thing, when I connect MEP is disabled, I can only choose from the sites.

But someone else in the company, with the same software, can choose from the Gateways.

It always defaults to the wrong gateway as well.

What's going on here?

[simonemantovani]

did you disabled MEP after the user created the VPN site? Because I noticed that sometimes, if the user connect when the MEP is enabled, and then you disable MEP, the Endpoint client ignore the change and you need to delete and recreate the site.

Maybe this is your scenario.

[Secret-goblin-5]

Been caught out by that before!

No, the VPN sites were deleted and re-created, so not that.

[simonemantovani]

Before involving the TAC, you could check this SK (https://support.checkpoint.com/results/sk/sk75221), and in case verify/modify the trac.config on the affected clients

[Secret-goblin-5]

I found the file but it is just hex code for me, nothing I can edit.

And the GUI has very few edit options. The SK also focuses on the file on the gateways rather the end end user machines.

                :ips_of_gws_in_mep (
                        :gateway (
                                :default (client_decide)
                        )
                )

I did fail to put in an IP for the above, so maybe that is the cause. But I still don't know why it effects one user and not me (well, unless it is client side and somewhere in the hex of trac.config)

[PhoneBoy]

You can unobscure trac.config: https://support.checkpoint.com/results/sk/sk55120 

[Martijn]

Hi,

Is the issue still there?

Did you changed the trac file on all involved gateways? You post only mentions FW1.

Regards,
Martijn

[Secret-goblin-5]

OK, issue resolved.

In https://support.checkpoint.com/results/sk/sk78180 After step 6 there is an extra step. I forgot to do that.

My code to fix the issue (I need to run it most times I patch these FWs)
(All in expert mode)

The commands below do these actions:

• Checks current status
• Backs up file
• Makes the edit
• Checks status again & checks the difference between backup and edited file

more $FWDIR/conf/trac_client_1.ttm | grep ":automatic_mep_topology (" -A 9

cp $FWDIR/conf/trac_client_1.ttm $FWDIR/conf/trac_client_1.ttm_ORIGINAL

(The next bit was written by AI, my bash is not good enough, but it does work)

Turn MEP off

awk '
/:automatic_mep_topology[[:space:]]*\(/ { inblock=1 }
inblock {
    gsub(/:default \(true\)/, ":default (false)")
    gsub(/:client_decide \(client_decide\)/, ":client_decide (false)")
}
/^\)/ && inblock { inblock=0 }
{ print }
' $FWDIR/conf/trac_client_1.ttm > /tmp/trac_client_1.ttm.new && \
mv /tmp/trac_client_1.ttm.new $FWDIR/conf/trac_client_1.ttm

Set Correct IPs (Run only one copy of the script for each location)

# London
awk '
/:ips_of_gws_in_mep[[:space:]]*\(/ { in_ips=1 }

in_ips && /:default[[:space:]]*\(/ {
    print "                     :default (1.2.1.1&#1.2.1.2&#1.2.1.3&#)"
    in_ips=0
    next
}

{ print }
' $FWDIR/conf/trac_client_1.ttm > /tmp/trac_client_1.ttm.new && \
mv /tmp/trac_client_1.ttm.new $FWDIR/conf/trac_client_1.ttm

# New York
awk '
/:ips_of_gws_in_mep[[:space:]]*\(/ { in_ips=1 }

in_ips && /:default[[:space:]]*\(/ {
    print "                     :default (1.2.2.1&#1.2.2.2&#1.2.2.3&#)"
    in_ips=0
    next
}

{ print }
' $FWDIR/conf/trac_client_1.ttm > /tmp/trac_client_1.ttm.new && \
mv /tmp/trac_client_1.ttm.new $FWDIR/conf/trac_client_1.ttm

Check Results

grep -A9 ':automatic_mep_topology (' $FWDIR/conf/trac_client_1.ttm

grep -A5 ':ips_of_gws_in_mep (' $FWDIR/conf/trac_client_1.ttm

diff $FWDIR/conf/trac_client_1.ttm $FWDIR/conf/trac_client_1.ttm_ORIGINAL

This shows the difference between the backup and the new file, plus shows the area there the files are changed.

This allows you to run through the process without manually modifying the file each time. Really useful if you have to do this every time you do a major patch.

Hopefully it helps someone else.