Remote Access Endpoint VPN policy is not matching the rule

[Blason_R]

Hi Team,

I have R80.30 firewalls and R80.40 mgmt server. It has been upgraded from R77.30 almost a year back and now I would like to enable Application and URL filtering blade on policy hence activated the same from Manage policy and layers.

However since I have Remote access Endpoint client based VPN rules setup in legacy mode like this

I am unable to do so and while installing policy it throws error. Then I tried converting legacy user access to access role however users are successfully getting authenticated but they are unable to connect as per policy and traffic is getting dropped on clean up rule. So I disabled Rule#9 and enabled Rule #8; however traffic is getting dropped any reason why?

Am I missing anything here?

[Blason_R]

Oh! By the way these are local users configured on firewall.

[PhoneBoy]

Have you enabled Remote Access as an Identity Source in the gateway?
It’s not enabled by default.

[Blason_R]

Yes this is enabled and I confirmed that. What could be other reason?

[mcatanzaro]

Hi,

I would check that the pdp is associating the AR with the users by running:

# pdp monitor user <user>

I would imagine this would be the cause if the IA settings etc. are correct.

Here is my user matching a rule correctly based off the AR detected by the pdp:

If the pdp isn't detecting the AR then you will want to recheck the configuration/debug pdpd to get more info.

[Blason_R]

Thanks I need to verify that. let me revert with my findings then.