[FW-1] Trouble with NG and SecuRemote

[Fábio Rocha <fabior@FW1-NOSPAMESTACIO.BR>]

Hi,

I am having a strange problem with SecuRemote and FW-1, my setup is: Linux
with NG FP3 and SecuRemote (build 52097) on Windows 2000.

My SecuRemote has these options checked: Force UDP encapsulation, Use IKE
over TCP, Transparent mode.

On the top of my rulebase there is:

-Src-                           -Dst-           -Services-      -Action-        -Track-
MyRemoteUsers@any               any             any             ClientAuth      Log

In the FW-1 I also did the following:

(In VPN manager) MyRemoteUsers were added to the remote access community, as
well as my firewall object as a participating gateway.  There are no
policies defined under desktop security tab as I do not intend to use Secure
Client, only SecuRemote.

(On Global Properties) Gateway supports IKE over TCP, No policy is required
for desktops.



Then, when I start SecuRemote remotely the following happens:

- I can authenticate with the firewall;
- A tunnel is indeed established;
- I can PING my internal machines ( I can see decrypt ICMP on the logs while
I do this );
... but when I try to ssh or telnet to one of them for example, the firewall
drops the packet on the last rule (drop all, log) although it is allowed on
the top of the rulebase.

- Everything that is allowed by rule 0 also works (I can ping, I can query
my internal name servers, etc.). It looks like my firewall is ignoring my
group membership...

Anyone has already seen this? Any comment will be greatly appreciated.

TIA,
Fábio.

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================