capsule vpn connect but no access any server

[Geomix7]

Hello Guys!

 Ihave the below scenario.I am writing about r77.30.Client connect through capsule vpn successfully.

Then try to access certain internal server with RDP without  success.From devices(ipad & android phone) i ask him and tried various rdp client without success.Also note that those servers are works properly through mobile access.Finally with fw ctl zdebug drop tcpdump i cannot see any logs.

Any suggestions?

[Wolfgang]

GGiorgakis,

Capsule Connect VPN is a full VPN client. You have to configure remote access rules to use them.

These rules are different from MobileAccessBlade rules, they are the same as for a normal Windows VPN client like EndPoint VPN.

If you use SSL-extender and native applications via MOB, you can't use this rules with Capsule VPN. 

Add your gateway to the remote access community, create rules with users as source, your needed destinations and services and in the VPN section add the remote access community.

Wolfgang

[Geomix7]

Dear Wolfgang,

I have already configure the above.
I got a successful capsule vpn connection.Then i try to connect and cannot see anything either with fwmonitor & zdebug.

[Jerry]

"connect where" ? what are you trying to achieve here?
where about you're trying to connect to?
have you got that configured on MAB Policies?
did you configured office-mode properly or you don't use it?

just answer above please otherwise we're struggling to assist you here really

[Geomix7]

Dear Jerry,

"connect where" ?
i connect from android device through vpn capsule and i received an office mode IP address.

what are you trying to achieve here?
I have a rule which legacy user access can login to a server (VPN:remote access included) port:3389

where about you're trying to connect to?
src:legacy user - dst: local server vpn:remote access - port:3389
have you got that configured on MAB Policies?
No
did you configured office-mode properly or you don't use it?
Configured

[Jerry]

so you answered yourself then 🙂
you need Mobile Access Blade console (Dashboard) and have policies configured for the VPN user to be able to reach tcp/3389 RDP from the "client" to the "server". Simples.

see MAB Admin Guide (

https://dl3.checkpoint.com/paid/77/774c3c923f00c927527600aadaab3fcf/CP_R80.10_MobileAccess_AdminGuid...

or

https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_MobileAccess_AdminGuide/html...

hope it helps

[Jerry]

MAB policies !

[Geomix7]

Add the network into VPN domain and works properly.

Thanks

[Wolfgang · Accepted solution]

Jerry,

I think for "capsule connect" no MAB policy is needed.

snip from MAB dosumentation

"The Mobile Access policy applies to the Mobile Access portal and Capsule Workspace. It does not apply to Desktop clients or Capsule Connect."

Wolfgang

[Jerry]

agree but I was in a believe that the main issue isn't about Capsule only but about inbound VPN clients connectivity in gernal hence my tips on that matter. cheers Volfgang

[Matlu]

Hello @Wolfgang 
To use CAPSULE on iPhone/Android, do you need to have the “Mobile Access” blade enabled in your FW?
Currently, my remote users connect using the IPsec VPN blade, using the “Endpoint Security VPN” client, since most of them use PCs to connect, but we want some of them to be able to use their mobile phones for their connections. However, we are unsure whether it is necessary to enable the “mobile access” blade for this.
Thank you for your comments.

[PhoneBoy]

Remote Access clients of all varieties can use either IPsec VPN OR Mobile Access without issue.
The only time you need to enable Mobile Access is if you want to use the SSL VPN portal.

[Matlu]

Hello,
Could you tell me in which file a remote VPN user's connection attempts are saved?
I have users who are trying to connect using CAPSULE and are unable to do so.
Are there any diagnostic commands for CAPSULE client scenarios?
Thank you.

[Don_Paterson]

Did you check the gateway logs?

There are steps in this SK for collecting logs on the client side. 

https://support.checkpoint.com/results/sk/sk106755

Tap the "info" (the i in the circle) icon

Tap on the 3 aligned dots (settings) in the top right

Tap "Configure logs"

[Don_Paterson]

My understanding was that the IPSec VPN blade only supported SecuRemote. 

For the gateway to support all other clients it needed Mobile Access as well. 

Should be confirmed here:

https://support.checkpoint.com/results/sk/sk67820

Also confirmed by launching the Mobile Access wizard and hovering the mouse cursor over the different client types. The popup text says which license is required.