R82 Gateway - Public Interface - Extender.html

[CaseyB]

Running SMS / GW on R82 JHF-36.

A recent external scan is listing this URL: https://<public_ip>/extender.html as reachable. My search queries have not turned up a whole lot on this one. Visting the URL at least gets us this error:

• The URL you requested could not be found on this server.

We do not have the Mobile Access blade enabled, it was at one time, but we disabled it in R81.10 or R81.20, and of course SNX is also not enabled. I do not re-call this showing up in previous scans, but it very well could have and was not reported.

This is what we have for allowed clients:

The saml-vpn portal is not used, but maybe related to this?

[the_rock]

Never seen that before myself. I would definitely verify with TAC, though doing a quick search online, seems to be related to that option checked for check point mobile for windows.

Andy

[PhoneBoy · Accepted solution]

This is probably the legacy SNX portal, which is used only when MAB is disabled and SNX is enabled.
Note that SNX stands for Secure Network eXtender lending to the idea 🙂

I found an old SK that suggests you might be able to disable it as follows:

• Go to IPsec VPN - go to "VPN clients" - clear the box "SSL Network Extender".
• Go to IPsec VPN - Clientless VPN - clear the box "Support Clientless VPN".
• Go to "Policy" menu - click on "Install Database..." - select all Security Management Servers / CMAs / Domains / CLMs / Domain Log Servers.
• Install Access Policy on relevant gateways

If that doesn't fix it, suggest a TAC case.

[the_rock]

Good ol' snx...brings back memories...lol

[CaseyB]

None of those options are currently checked, so for fun I re-enabled them, installed DB / policy and the SSL Network Extender login page showed up. I re-disabled them and we are back at the original problem.

I will open a TAC case.

[the_rock]

I wonder if there might be a file that needs to be modified...anyway, let us know how it gets solved.

Andy