Hi CheckMates,
Let's suppose we have one SMS which can manage 10 SGs.
We manage 6 of these SGs, and rest (4) are managed by 3rd party company (we see these gateways in SMS, but somebody else manages them, and they have their own LANs, DMZs, etc).
And now we decided that we want to add 2 more SGs that will act as VPN gateway for our remote users.
As we all know MEP is enabled by default, which we can of course change from "true" to "false" or "client_decide".
So if MEP is set as "true" ... what will remote user see after he will add new site in Check Point Mobile/Endpoint Connect ?
Soon after first connection topology will be downloaded from this VPN gateway and on next connection user will see a new option - select box - where he will see EACH AND EVERY gateway that are in RemoteAccess VPN Community.
If there will be only these newly added VPN gateways - he will see only these two.
But what if administrator from this 3rd party organisation will enable IPSec VPN blade and add one or more of these 4 SGs to the RemoteAccess VPN Community ?
Our remote users will see our 2 VPN gateways ... and these gateways of 3rd party organisation in this select box ... and 3rd party organisation remote users will see theirs gatewa ... and our 2 VPN gateways...
Two questions:
1) Do you know if there is some option to "filter" which gateways could be chosen by remote users for MEP (so that ours remote users should see only our 2 VPN gateway, and remote users from 3rd party organisation should see only theirs 4 gateways) ?
I was thinking about trac_client_1.ttm file ... but I don't see anything about that...
However I know that this file doesn't contain everything ... for example if you want to allow remote users to exclude localy connected networks from Hub Mode ... you need to add special entry to this file.
So perhabs there is something similar regarding MEP ?
Eh... if we could have more then one RemoteAccess VPN Community .... but we can't 😞
2) Even if Customer will select one particular gateway from this select box ... client's application connects to different gateway (each and every time it is the first one from the list) - even that I have option "client_decide" in "automatic_mep_topology".
How can I change that. It looks like as if "client_decide" for "mep_mode" is the same as "first_to_respond"...
Or maybe each Customer should change file C:\Program Files (x86)\CheckPoint\Endpoint Connect\trac.defaults regarding MEP .... it would be absurd.
Excerpt from $FWDIR/conf/trac_client_1.ttm:
(...)
:mep_mode (
:gateway (
:map (
:dns_based (dns_based)
:first_to_respond (first_to_respond)
:primary_backup (primary_backup)
:load_sharing (load_sharing)
:client_decide (client_decide)
)
:default (client_decide)
)
)
(...)
(...)
:automatic_mep_topology (
:gateway (
:map (
:false (false)
:true (true)
:client_decide (client_decide)
)
:default (true)
)
)
(...)
As you can see these are default settings.
I can understand that with "automatic_mep_topology" selected as "true" client's application will not be able to select gateway - this choice will be done "automatically" based on some parameters.
But if this option will be changed to "client_decide" ... in my opinion gateway that will be chosen, should be this one selected from select box by the user ....
What do you think ?
--
Best
m.
