Can't access Mgn though VPN

[Satto]

Hi,

I have many site behind a private ISP (Have no control here), all site is cluster, all running R81.20.

All site communicat to the Management server directly on the private ISP network, and all GW is member of a meshed VPN.

All the FW have no problem communicat to the Mgn, all cert and keys are update, so no problem here.

The VPN tunnel has no issue between the 192.168.x.x network, the problem starts when we need to communicate to the 10.161.100.x network, that is behind the FW1.
No problem with access from Com1 to Mgn, but Com2 or 3 can't talk with Mgn.

Mgn can't use the smtp mail server that is locate behind FW3, or ping any other network that belongs to the VPN network.

What I can see in the log, is that all Mgn request is route directly out on the external Interface on FW1.

Same happen to Com2 and 3, the request is going out on the local FW external interface.

All site proberly know that the 10.161.x.x is on the external network, so it just send it there.

I don't want any Mgn traffic with other Gateways stop working, but how can I trik the system to send local request to the Mgn server on the VPN network?

Hope you have the info you need... (Network pic is include)
/Steen

[the_rock]

What does zdebug show?

Andy

[PhoneBoy · Accepted solution]

So this is traffic from the management server itself, correct?
By design, management traffic is NOT routed through VPN.
To fix this would involve hacking implied rules and such, which will make management traffic dependent on the VPN being active.
This is not recommended.
Read the following two (similar) threads on this topic:

• https://community.checkpoint.com/t5/Management/Exclude-CPM-Traffic-from-Implied-Rules/m-p/9187
• https://community.checkpoint.com/t5/Management/Exclude-CPM-traffic-from-implied-rules/m-p/3934 

[the_rock · Accepted solution]

Right, always forget about that. @Satto , below sk should help too.

Andy

https://support.checkpoint.com/results/sk/sk105719

[Satto]

Hi,

Thanks for all your answer, but Im not sure that we are on the right track.

I have 2 problems, if we look att the mail problem first, maybe i'll better understand the smartconsol/cli problem later.

So why does the FW1 send the mail trafic from the Mgn server out on the Internet interface, when it knows that the 192.168.4.0/24 network is behind the FW3 using VPN.

The network 10.161.100.0/24 is published by our Privat ISP and route to 10.161.1.11, it is used as a type DMZ.

@;15761032.89339;[vs_0];[tid_1];[fw4_1];fwuser_process_packet: Got packet dir 1, 10.161.100.100:31306 -> 192.168.4.200:0 IPP 1, with dir 0 ;
@;15761032.89348;[vs_0];[tid_1];[fw4_1];cpxl_chain_handler: <dir 0, 10.161.100.100:31306 -> 192.168.4.200:0 IPP 1> is not accelerated (EXFLAG set), returning;
10.161.100.100 -> 192.168.4.200 ICMP type 8, code 0 ;
10.161.100.100 -> 192.168.4.200 ICMP type 8, code 0 ;

/Steen

[the_rock]

For that, did you try turn off sxl as a test?

Andy

[Satto]

Hi,

No difference in behavior when off.

/Steen

[the_rock]

K, fair enough. I would double check with TAC via remote session, just to make sure possibly something simple is not missing here.

Andy

[PhoneBoy]

It's exactly what I said above: traffic from the management (ALL TRAFFIC not just that for managing gateways) is NOT sent over VPN.
This is by design.

[Satto]

Hi,

Okay, so if I want to send email using a server on another site, It need to connect on the outside of the GW on that site?

Thanks, is nice to understand why, so i don't need to trace the error anymore.

/Steen

[PhoneBoy · Accepted solution]

Something outside of the encryption domain, yes.