Problem with checkpoint vpn android app

[jdominguez]

I have a problem and I hope someone can help me. We have checkpoint 5600 firewalls in version R80.30. When I try to connect from the outside with the checkpoint mobile applications, the Iphone mobiles work fine but the android phones with the checkpoint vpn app seem to connect, they take ip but then it is as if they were not really connected. They can't ping, they can't https ... Does anyone know the solution?

[PhoneBoy]

We talking the Capsule VPN?
What version of client?
What version of Android?
What do you see on the gateway side when the Android tries to connect?

[jdominguez]

Hello, thank you for your help. Yes, I Am talking capsule vpn. As soon as I know the version of android app and app version I will tell you.

[frass]

Hi PhoneBoy.
The condition I experienced was similar, when the user connected through Capsule VPN with version 1.600 experience the user got the error "KMP server returned an error" and also got the error "Failed in setting command - Permission denied". But if I check from the log, the action is "Log In" but does not get IP Office Mode which is our vpn ip pool.

If got the vpn pool, in section "Session" will occur IP Office Mode.

[the_rock]

Phoneboy is right, we need wayyyy more info. What do you see on the gateway? One phone issue, multiple? Any specific logs when this problem occurs? Capture?

[jdominguez]

j

[jdominguez]

Hello, thank you very much for your help. I think the error is from the android app. I have no problems with the iphone app. However, with the android app, it seems that it connects, receives the ip but from that moment on, nothing else can be done. The firewall logs only indicate that it has connected but then I do not see anything else. As soon as I can try it again  I will put an app and android version.

[Nicolas_Calvo]

Hello, We have the same issue.

• CheckPoint Capsule 1.600.72
• Phones Samsung with Android 11 (Kernel 4.14.113-22340597). Several models with this issue (S10, A53, xcover 4s, xcover 5, ...)
• Firewall R81 Gaiga Kernel 3.10

Screenshot from a Samsung S10. (look at "Decrypted Packets" and "Decrypted bytes"):

Screenshot from console (Although I have generated traffic, no traffic is reflected):

The same thing happens to other colleagues from other companies

Could you help us?

Thanks in advance.

[Denis_Davila]

Hi Nicolas, 

In my situation, the error is exactly the same. I can´t find any solution for this case. 

Do you have any idea?.

[Awacs2000]

Hi,

is there any solution for this?
I have the same issue with my Samsung S22 and Capsule. I can´t reach anything in my network.
With my Notebook it works fine.

[jdominguez]

Hello.

My problem was solved by tapping the connection type on the Android mobile, by default it was set to IPSEC when it was a vpn.

Regards.

[the_rock]

I would say thats common "mistake" people make, but easy fix.

Best,

Andy

[Awacs2000]

Where in Android should this be?
I can't find anything about it in the settings. In the "VPN" settings of Capsule (Version 1.601.26) I can only set whether the VPN should always be on or delete the profile. That's it

[the_rock]

I use Iphone, so cant test it myself, sorry, but I know for a fact it used to be there before. Do you not see it once you are creating a site?

Best,

Andy

[Awacs2000]

It looks like this:

[the_rock]

Does not give option to change connection type once connected?

Best,

Andy

[Awacs2000]

No, there is no option. I clicked every single dots, points or whatever, but I cannot find anything to change this.
Does no one use Android here? Maybe this is only a Android version issue. As mentioned, I use a Samsung S22 with newest software.

[the_rock]

Lets see if someone with that exact phone can test it. Sorry, I honestly would not know then : (

[the_rock]

I see one screenshot says tunnel type ipsec, if you are inside connection properties, you dont see anywhere where you can click to change it to vpn instead or ssl vpn or something?

Andy

[Awacs2000]

No, the only thing I can click in the upper right is the "I"-Button
Inside this I can just see "All rights reserved.........." bla bla bla and in the upper right I can configure logs and send them via mail.
Thats´ it.

[the_rock]

OK, I did a test on my Iphone in the mean time, so you tell me if you see something similar. So I created brand new site on capsule app, it asks you for auth method (bla bla bla), once you choose so, then, on my phone, you can hit "i" icon and choose there type of connection, ipsec or ssl vpn.

You dont see that on your phone at all?

Andy

[Awacs2000]

No, I tried those steps again, but there is no chance to change anything.
I will try with my iPad later.

[the_rock]

Then I got nothing else, sorry : - (

Andy

[Awacs2000 · Accepted solution]

STOP STOP STOP, BREAKING NEWS 😉
I just tried it on my iPad and there it is working with the "I".
Then I checked the Android again and there you have to click ">" right of the connection name and you are then able to "Edit site". Now I was able to change to SSL and it is working (pretty fast)

Thanks a lot!

[the_rock]

I knew had to be something minor. Excellent job! 🙂

Best,

Andy