Problem to access some DFS shares via Mobile Access

[Andree_Bengtsso]

We have a strange issue with access to DFS shares.

This is our setup:

• We have one common remote access gateway based on a Check Point 4600 cluster with R77.30 Hotfix Take 216. At this office we have one DFS share that works.
• Then we have two other locations connected with MPLS, these locations also have 4400 Cluster R77.30 Hotfix Take 216. Here we also have DFS-Shares, but here only one works without any issues. Many users cannot access that DFS-share. (this does not affect all users yet, but the problem becomes bigger and bigger).
• Ruleset are same for all locations. We don't see any drops or blocks in the logs.

Problem so far only affects some Windows 10 pc, not all. But every new day we hear new users who got this problem.

We tried to update the mobile access client but it's still same problem. We mainly use E80.65 and E80.70.

(DFS-servers are based on Windows Server 2012 R2). DFS share is: Domain\sharename1, 2, 3

All computers are members of the same domain. Even if we can't access the DFS-Share, we can ping the dfs-share host.

Windows patches are the same.

Anyone who had similar problem?

Thanks in advance!

/Andrée

[PhoneBoy]

DFS shares are not officially supported with Mobile Access Blade.

Refer to: DFS support for Mobile Access / Connectra NGX Portal 

It is something I believe will be addressed in later releases, but timelines haven't been finalized.

[Andree_Bengtsso]

Thanks for info!

We are mainly using the Check Point Mobile client for Windows E80.65 or E80.70 to connect. And this does not use the Mobile Access blade if I understood correctly.

However, I tried now to login via the SSL Network Extender and then I could access this DFS share that doesn't work with the Check Point Mobile client.

Also I've tried the "Check Point Capsule VPN for Windows 10" client and that also works.

Are there any info about that client what's supported and not ?

[PhoneBoy]

The lack of DFS support only applies to the web-based portal of Mobile Access Blade.

The E80.65/E80.70 client can use Mobile Access Blade, but it depends on how you configure it.

Either way, it should work with the various VPN clients. 

As to why it doesn't work with the Check Point Mobile client but it does with the others, I'm not sure.

It would be worth raising an SR with the TAC.