The users capsule keeps reporting an IP IP Address.

[Eric_Speake]

We are seeing that when we have users that go out of the U.S. and when they come back capsule is still reporting the foreign IP address for 5 days. Is there a way to clear this automatically. How can we make it report the actual current IP.  When they come back into the U.S. we get an alert about traffic from a foreign IP.

As an example we have a user that went to Canada. For 5 days after their return the logs shows them connecting from the last IP address is Canada they used.

Thanks,

Eric

[PhoneBoy]

This sounds like a Capsule Cloud question (which runs on laptops) rather than a Capsule Workspace question (runs on mobile devices).

Can you clarify?

[Eric_Speake]

This is on their mobile devices the issue is occurring. We currently are only deploying to mobile devices. Our Capsule users connect to the VPN with laptops to check email.

Thanks,

Eric

Sent securely from my Android

[Daniel_Dor]

Hi Eric,

The Capsule family has few different products:

1. Capsule Cloud

2. Capsule Docs

3. Capsule Workspace

Could you please describe the architecture you use and the exact product you use so we can better understand the problem?

D

[Eric_Speake]

Daniel,

We use capsule workspace to allow access to email, calendar, and some internal web applications. We use Microsoft exchange for our enterprise mail. We have users that will travel to Canada and Mexico to work with venders and when they return to the U.S. for the next five days when they connect with Capsule Workspace the IP address that is presented from capsule from that device is the IP address from that was used while they were out of the country.

This triggers an alert on our IPD, checkpoint FW as well. We confirm that they have returned to the U.S. and have them to whatismyip.com to confirm the IP address they are getting for the data connection on the phone or tablet. So the IP is being held in some type of cache storage. We need to know if there is a setting or a way to clear that so we are not investigating false positives in out IPS.

Thanks,

Eric Speake

Senior Systems Administrator

Information Technology

O'Reilly Auto Parts

(417) 862-2674 Ext. 1975

[Daniel_Dor · Accepted solution]

Hi Eric,

I think that because of the fact they "open a session" in Canada or Mexico, it remains open even when they get back to the US.

Please run the following steps and let me know if it works:

1. When one of you guys have this issue -> Check the IP he currently gets -> then tell him to enter Capsule Workspace

2. Then sign out of Capsule Workspace

3. Then sign in again using his AD Credentials 

4. Then look at the IP address (if it was changed)

Please let me know what is the issue so we can decide what would be best way to approach this.

D

[Eric_Speake]

Daniel,

We are seeing an authentication that creates a session for 168 hours. Unless there is another authentication it appears to keep the IP address.

Is there a way to shorten that time frame and or make workspace always use the current IP on the device?

Thank you,

Eric

[Daniel_Dor]

Hi Eric, how are you?

To solve this, please answer the following questions:

1. Are you referring IPs displayed in the SmartView tracker? Do you mean that even when the devices are connected in the US , they displayed as if they are using the same IP they used when they started the VPN Session (i.e. Mexico's IP?)
2. Can you send Snapshots of SmartLog Tracker with an example? (the best way would be to open Sevice Request via Check Point Site)
3. Do you have the same issue when connecting with Capsule Workspace both to Wi-Fi and 3G?
4. Let’s say we sign out in Mexico from the session and re-sign in the US. Does this solve the issue?

Thanks.

D