ipassignment.conf -- is there a logfile to check assignment requests

[Net_Works]

Hi All,

I have a user connecting to the gateway via VPN (SAML authentication). They pass SAML authentication via identity provider but get assigned the wrong IP address. Although they are setup in the 'ipassignment.conf' file, they keep getting an IP address from the general pool that is setup on each cluster member. I have checked the syntax in the ipassignment.conf and satisfied they have been configured correctly. 

Is there a logfile anywhere that I can troubleshoot this to check that the  ipassignment.conf file is being queried?

Thanks in advance.

[the_rock]

I dont believe you could search by say file name itself, but what you can do is something like below (in logs and monitor from smart console, just do below search, assuming say OM ip someone gets is 172.16.10.55)

blade:VPN AND src:172.16.11.55

Hope that helps.

Andy

[PhoneBoy]

From https://support.checkpoint.com/results/sk/sk113461 it appears you might find this in vpnd.elg.
You'll probably need to enable debugging of this process, however, which is done as follows:

# vpn debug trunc
# vpn debug on TDERROR_ALL_ALL=5

Then review $FWDIR/log/vpnd.elg* for the relevant user.
To disable debug:

• vpn debug off
• vpn debug ikeoff

As debugs can cause extra load, you may want to do this during off hours or a maintenance window.
See also: https://support.checkpoint.com/results/sk/sk180543 

[Net_Works]

Thanks PhoneBoy -- this has provided some useful info however, not managed to capture the individuals vpn negotiations or address assignment.

Running 81.10 BTW

[Net_Works]

Have managed to resolve this issue -- the user had changed his name in AD (from Rob to Robert) so the ipassignment.conf file was being ignored.

Would still be useful to find how to debug this.

Thanks

[the_rock · Accepted solution]

Good job! 👍

Hope below links are useful for debugging on top what @PhoneBoy gave you.

Andy

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[G_W_Albrecht]

How could these be usefull ? The two provided links are supported in ancient EOL versions only...

[the_rock]

Correct, thats what it says, but TAC also used them few times on the phone, so they definitely do apply even in new versions. I suppose the articles were not updated to reflect so.

[G_W_Albrecht]

But in fact they state explicitely the opposite: This solution is about products that are no longer supported and it will not be updated

So i would rather not suggest them to anyone when supported alternatives are available.

[the_rock]

I agree, so maybe TAC people should be advised not to use them any longer 😂

[G_W_Albrecht]

No, TAC can use anything, but i think you should avoid refering to unsupported SKs - sk30583: What is FW Monitor? has all of that in an officially supported SK...

[the_rock]

Personally, I dont care what they use, as long as problems are fixed 😊

[Net_Works]

Thanks Andy -- second link is useful 👍

[the_rock]

Glad its useful. But, @G_W_Albrecht is correct, it does indeed mention its not officially supported, but TAC used it with me over the phone few times, so must be still "valid" ; - ). Not to sound ironic now, but again, personally, @Net_Works I could care less who I talk to and what methods are used, the end goal is to fix the issue and Im sure thats what every client cares about 🙌

[PhoneBoy · Accepted solution]

The point of pointing you at the debug was to see what username it was seeing in order to find the relevant ipassignment.conf entry.
To see who is connected with what IP, perhaps this will be helpful: https://community.checkpoint.com/t5/SmartConsole-Extensions/Show-VPN-Users/m-p/131493#M200 

[Net_Works]

Thanks PhoneBoy -- will take a look on Monday 😉

[Net_Works]

Hi PhoneBoy -- this is a really useful cli output (fw tab -t . . . ) and does provide me with the details of the username which I could have cross referenced with the ipassignment.conf file 👍

Thanks all for your contributions.

[the_rock]

Also, not sure if below might be 100% applicable, but worth a look.

https://support.checkpoint.com/results/sk/sk105162