[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[FW-1] RES: [FW-1] Trouble with NG and SecuRemote
>You can ping the same boxes that you can't ssh or telnet to?
Yes, exactly.
More accurately, I am able to do anything that my rulebase allows to come
from "Any" (i.e. anywhere), that is, somehow the firewall seems to be
ignoring what MyRemoteUsers� rule state.
Regards,
F�bio.
-----Original Message-----
From: F�bio Rocha [mailto:[email protected]]
Sent: Friday, November 01, 2002 10:34 AM
To: [email protected]
Subject: [FW-1] Trouble with NG and SecuRemote
Hi,
I am having a strange problem with SecuRemote and FW-1, my setup is: Linux
with NG FP3 and SecuRemote (build 52097) on Windows 2000.
My SecuRemote has these options checked: Force UDP encapsulation, Use IKE
over TCP, Transparent mode.
On the top of my rulebase there is:
-Src- -Dst- -Services- -Action-
-Track-
MyRemoteUsers@any any any ClientAuth
Log
In the FW-1 I also did the following:
(In VPN manager) MyRemoteUsers were added to the remote access community, as
well as my firewall object as a participating gateway. There are no
policies defined under desktop security tab as I do not intend to use Secure
Client, only SecuRemote.
(On Global Properties) Gateway supports IKE over TCP, No policy is required
for desktops.
Then, when I start SecuRemote remotely the following happens:
- I can authenticate with the firewall;
- A tunnel is indeed established;
- I can PING my internal machines ( I can see decrypt ICMP on the logs while
I do this );
... but when I try to ssh or telnet to one of them for example, the firewall
drops the packet on the last rule (drop all, log) although it is allowed on
the top of the rulebase.
- Everything that is allowed by rule 0 also works (I can ping, I can query
my internal name servers, etc.). It looks like my firewall is ignoring my
group membership...
Anyone has already seen this? Any comment will be greatly appreciated.
TIA,
F�bio.
=================================================
To set vacation, Out Of Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================
=================================================
To set vacation, Out Of Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================
=================================================
To set vacation, Out Of Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================