We have this week applied an upgrade to our Checkpoint firewal - NGX R65 HFA 50 - and now cannot create new sites from SecuRemote clients.
Neither can some current users use the VPN once it has been created - they can connect, but our firewall is receiving no traffic from them.
My laptop was working so I removed the site to recreate and now it just cannot find the firewall, even though a ping to the IP address reports as an error on the firwall with pings blocked.
We see no traffic or attempts to connect on the firewall from my laptop now trying to create the new site.
My other PC is working fine with the old site left and I am currently connected and managing the firewall.
Even reverting back to the pre-upgrade image has not worked.
The only other change was to correct the stealth rule to block traffic and not allow everything - but putting this back to allow all traffic still won't allow the securemotes to connect.
HELP!!!!!
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
No - using secureIDs which is why I am surprised it is asking for a certificate, especially as my machine here and one at home still connect fine.
I did roll back from the upgraded firewall to the pre upgrade image, and then re-apply the upgrade - could that have been the issue?
How do we generate a new SIC?
It's been several years since iI had to get dirty with Checkpoint!!
Any invalid certs normally implies an issue with times as CRLs cannot be validated etc. Common prob when you rebuild units and forget to sync time fully.
The certs it was failing on will be due to the server cert that the firewall uses to validate itself to teh client,. If the cert is out of date (due to wrong time settings,) things get nasty as you found out.
Let us know how the rest goes.
Business Accounts
Answer for Membership
by: deimarkPosted on 2009-11-09 at 00:48:30ID: 25774231
Can you tell us what you upgraded from to get to R65 HFA 50?
Also, if you have a working site on secure client, then I would copy the userC.c fole from a working client and copy this to a failed client and test again.
This will get you up and running in theshort term and allow us to find out why this does not work.
The userC.c file is normally found in C:\Program Files\CheckPoint\SecuRemot
What logs do you see in tracker? Ensure that you are logging on implied rules as well, just in case the upgrade has played with them.