I cannot login VPN "site is not responding" Issues

[JordanHsu]

Dear Sir,

I am Jordan from Taiwan and I am a newbie when it comes to CheckPoint Gateway.

I have encountered a sudden problem when I entered the command "fw unloadlocal" in my 6200 gateway's command line interface (CLI).

My mobile VPN function stopped working, and I have tried to find a lot of documentation to solve this issue, but without success.

I appreciate any assistance or guidance you can provide to help me resolve this matter.

Thank you for your support.

attachment

 

is my log and snapshot. 

[Lesley]

This command removes installed policy from gateway. Are you able to reinstall to policy on the 6200 cluster?

If not try fw fetch

[JordanHsu]

Hello Lesley, 

Thanks you for the replied 

Yes, i see the command will be removed all policy, 

When i do this then i will reinstall back the the policy.  

However how do i use the command of "fw fetch" , What does the command function to what ?

[G_W_Albrecht]

R81.10 Quantum Security Gateway Guide - fw fetch

Seems your policy does something wrong if WebGUI is blocked.

[G_W_Albrecht]

Also a reboot should be able to heal it. But why use the command "fw unloadlocal" at all ? Should not be needed except in very special situations (when you did something completely wrong in rule base so SMS can not reach it after policy  install).

[JordanHsu]

Hello Albrecht, 

Thank you for replied, Because somehow i have issue form the Gateway ,Such as webGui didn't work. 

That's very strange , When i installed the policy my web-GUI function will going to down. Even i try to use port :4434 ,

If i meet this situation i must be use the commend to unload then install roll back. 

Unfortunately reboot didn't worked.  for my Mobile VPN..

[the_rock]

Just to clarify, say if initial policy loads on the fw, that would ONLY allow web UI access on port 443, not any other port. What happens when you install basic policy to the gateway, can you ping say google dns, 8.8.8.8?

If not, can you verify SIC is okay? Also, its possible that something with the routing could be wrong...just do basic test ip r g 8.8.8.8 command and you can verify.

Andy

[JordanHsu]

Hello Rock, 

Yes, from my firewall that would able to ping Google DNS 

Also i already use IP pool from my Gateway provided , So that's probably not a policy issue. 

BTW,  i try to access my FW via GUI with port 443 that did not able either.  but i can telnet 443 to it. 

   

[PhoneBoy]

When you unload the policy with fw unloadlocal, it also affects VPN functionality.
Obviously, you have some issue with your policy that you need to correct.
This is likely something you will need the TAC to assist with: https://help.checkpoint.com

[JordanHsu]

Hello PhoneBoy 

Thanks i will try it.