How Can the Gateway Automatically Release IP Addresses Assigned to VPN Users?

[JohnnyWang]

Is anyone else experiencing the same issue as I am?

Specifically, I currently have a Remote Access VPN configuration with a license capacity of 55 concurrent connections.

Initially, I assumed that the number of concurrent connections could be monitored through the Active Tunnels tab in SmartConsole. However, after checking with Check Point TAC, I found out that this is not how license consumption is calculated.

According to TAC's explanation:

1. Each connected Remote Access VPN user consumes one license.

2. The license remains consumed as long as the user's Office Mode IP remains allocated in the IP assignment table.

3. Even if a user disconnects, the license may still be considered in use if their Office Mode IP has not yet been released from the assignment table, for example, because the lease duration has not expired.

4. Therefore, the maximum number of Office Mode IPs that can be assigned at any given time is limited by the number of available Remote Access VPN licenses.

We have to check the number of allocated Office Mode IPs using the following command:

fw tab -t om_assigned_ips -s

If the IP assignment table reaches its limit, we currently have to clear it using:

fw tab -t om_assigned_ips -x

My question is: Is there any way to configure the Security Gateway to automatically release an Office Mode IP as soon as it detects that the corresponding VPN user has disconnected, rather than keeping the IP allocated until the lease duration expires?

I would appreciate any advice or recommendations from anyone who has encountered the same issue.