Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
AlexandruD
Contributor
Jump to solution

MGMT IP address not accessible via RA VPN

Hello,

Anyone knows why a security gateway would exclude its management IP address out of the RA VPN client's routing table?

Case in point, the RA VPN community encryption domain includes the whole 10.0.0.0/8 subnet, yet the 10.0.0.X IP address, which is the management IP address of the security gateway where the RA VPN is terminated, is not included in the connected RA VPN client's routing table. The RA VPN client is  Check Point Mobile and uses IPsec to tunnel traffic.

 

Thank you

0 Kudos
1 Solution

Accepted Solutions
AlexandruD
Contributor

Hello,

 

I finally got this working, it took a while for CP support to provide a fix, although a bit complicated for such a simple need:

- automatic MEP topology must be disabled oin the gateway, based on sk78180 (it already was disabled in my case)

- disable MEP topology retrieval in the VPN client's configuration, sk92676 (different than the default setting)

 

Screenshot 2023-10-18 220607.png

 

Best regards,

Alexandru

 

View solution in original post

6 Replies
the_rock
Legend
Legend

I just checked in one of customers' environments and works fine, no issues. Can you see what is output of route print from user's machine?

Andy

0 Kudos
AlexandruD
Contributor
 

Hi Andy,

Here is a snippet of a connected RA VPN client's provisioned routes. You can see that the routes exclude the specific 10.0.0.252 IP address (which is the MGMT address of the security gateway) from the rest of the routes within the 10.0.0.0/8 prefix. I cannot find any specific configuration for this behavior via SmartConsole, perhaps there might be some parameter I could ajust directly in the DB.

Screenshot 2023-10-10 215138.png

Best regards,

Alexandru

0 Kudos
the_rock
Legend
Legend

I dont really see anything specific, below is just referred to dns when people log in via RA.

Andy

 

 

Screenshot_1.png

0 Kudos
AlexandruD
Contributor

Hello,

 

I finally got this working, it took a while for CP support to provide a fix, although a bit complicated for such a simple need:

- automatic MEP topology must be disabled oin the gateway, based on sk78180 (it already was disabled in my case)

- disable MEP topology retrieval in the VPN client's configuration, sk92676 (different than the default setting)

 

Screenshot 2023-10-18 220607.png

 

Best regards,

Alexandru

 

the_rock
Legend
Legend

Thanks for the update! 👍

0 Kudos
PhoneBoy
Admin
Admin

Location Awareness enabled, perhaps?

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events