Connecting to Internal Network VPN/SSL Client

[Cristian_Rosa]

Hello guys,

How to prevent the user on the LAN internal network from connecting to the SSL VPN/Client itself. We come across this case, where the user should only be able to access an SSL VPN/Client when they are internal, not when they are internal.

I wouldn't want users to access our own SSL/Client VPN from the internal network.


Congrats,

Cristian Rosa

[the_rock]

Im not real sure what you are trying to achieve here. You dont want user thats internal to be able to access VPN client??

[Cristian_Rosa]

240 / 5,000

 

Yes When the user is inside the internal network, he connects to the SSL VPN as if he were externally. Should this happen? Does Checkpoint accept this connection, even the user within the internal network? I wish it weren't possible.

[the_rock]

You can restrict it, but there is no need to do this from internal. 

[Cristian_Rosa]

And how would I do?

Can you help me ?

Congrats,

Cristian Rosa

[skandshus]

Dont you have the ability to select the interface its accesible from?

i got that on several things if you open the gateway properties

[Cristian_Rosa]

I don't know how to inform. I searched but couldn't find where to configure it.

[the_rock]

Honestly, I never heard of a way to do this specifically from the firewall object itself or even global properties. There might be some way possible via gw file trac_client_1.ttm, but not 100% sure how. Maybe someone else will chime in and confirm for you. Personally, there would need to be some sort of mechanism that would recognize user being internal that would prevent them from even being able to connect, unless they come from external source.

[Cristian_Rosa]

Yes Exactly. I think this is the way I hadn't seen that happen yet.

[the_rock]

Lets see if someone else may have an idea, Im also interested to see the suggestions/advice or if its even possible.

[G_W_Albrecht · Accepted solution]

Yep - it is rather old and called Location Awareness:

SmartDashboard - go to Policy menu - click on Global Properties... - expand Remote Access - click on Endpoint Connect - in the Connectivity Settings section, refer to Network Location Awareness field - select Yes - click on Configure... button - enjoy the options...

[the_rock]

Ah, yes, good point, totally forgot about that.

[Cristian_Rosa]

Hello Abrecht,

Your help resolved my case.

Thanks a lot...


Cristian Rosa

CCSA

[Wolfgang]

@Cristian_Rosa you can disable the implied rule for MOB access if you switch your gateway object configuration "Accessibility" to "According to the Firewall policy"

With these setting you have to define access rules for access to the MobileAccessPortal like this one