Thanks for the quick response. I actually read that from their online KB but that doesn't really seem to be my situation. It has two things that don't match.
1 - We have SecureClient NGX so Dead Gateway Detection is automatically set to zero by default.
2 - The office mode IP Pool is one subnet above the VPN Domain Internal LAN subnet so they don't overlap.
I also made sure I don't have any WINS servers being assigned.
So do you think the VPN IP Pool needs to have NAT turned on, maybe HIDE behind Gateway or something? I've even tried putting in a security rule to allow the VPN IP Pool to any, but still having the same issue.
Main Topics
Browse All Topics
by: deimarkPosted on 2009-06-24 at 09:31:02ID: 24702788
Try this: (taken from Check Point Secure Knowledge)
It may be the one you are looking for.
Solution ID: sk30481
Error: "encryption fail reason: Packet is from physical IP address but Office Mode is active"
Product: VPN-1 SecureClient
Version: NGX R60, NG AI R56, NG AI R54
Last Modified: 06-Dec-2006
Symptoms
* SecureClient log error: "encryption fail reason: Packet is from physical IP address but Office Mode is active"; traffic is dropped.
* This error occurs in Extended View, with profile option "Route All Traffic" enabled for Hub Mode.
Cause
SecureClient with Office Mode in Hub Mode adds a default route to the routing table when a connection is established. The original default route, made by the operating system, will remain in the routing table, but will have its metric increased. Windows has a mechanism enabled by default, called Dead Gateway Detection. This mechanism monitors multiple default routes to see if connections are failing through them. In the event of failure, Dead Gateway Detection changes the default route from the Office Mode gateway to the operating-system gateway. SecureClient will drop outbound packets that are not received through the Office Mode interface when Office Mode is enabled.
Solution
In most cases, the solution for this issue is to use Office Mode with a range of IP addresses that do not exist on the internal network or WAN. When connecting from a hotel that has an IP address range that overlaps the internal network, the firewall sees the connection attempt as an internal connection, and it will fail to authenticate. Dynamic Interface resolving will allow connections when a SecureClient's local LAN IP address (in this case from the Hotel) overlaps with the internal IP range used by the security gateway.
To disable the Dead Gateway Detection mechanism on NG AI R54 and R55, modify the registry as follows:
Note:
Always back up the registry before making any modification.
1. Select Start > Run.
2. From the Run dialog box, under the Open field, enter the command regedit
3. Locate the HKLM\SYSTEM\CurrentControl
4. Add the following DWORD with the value "0"
EnableDeadGWDetect
5. Save and exit.
6. Reboot.
Note:
Security Administrators can add a script to turn off this registry flag, in the post-installation script in the SecureClient package. To specify a post-installation script, add the file's name to the [install] section of the product.ini file. The script is not part of the package, and should be transferred to the client separately.
Other possible sources of the error:
* The Office Mode IP pool must be assigned a network that does not overlap with the VPN Domain.
* Verify and remove the Office Mode IP Pool range from the VPN Domain group.
* Do not configure WINS in TCP/IP properties, to avoid conflict with the Office Mode settings.
Note:
On SecureClient NGX using Office Mode with Route All Traffic enabled, the Dead Gateway Detection registry flag is set to zero by default.