Restricting remote VPN users

[slash85]

(CheckPoint NG with Application Intelligence R55 Build 127)

Hi,

Is possible to restrict remote vpn users so that they can't access the whole network once authenticated? I guess you can but i can't seem to get it to work.

I've created a group called lockdown and added the required users (I only want them to be able to access 1 server on RDP). Then i've created a rule:

lockdown@svr1 svr1 any traffic RemoteDesktop ClientAuth Log

But once i've authenticated i can still get to other servers? I have missed something?


Thanks for any help / informartion.

Cheers,
Slash.

[dantro]

There are several ways to accomplish this. You should of course first check SmartView Tracker for the rules that allow your RemoteUsers unwanted access. In your case I'd simply create a second rule below your Accept rule:

lockdown@svr1 any any traffic any Drop Log

Make sure no other rule above these two grants permission to your RemoteUsers.

What else could be done?
- you could define the allowed locations for your RemoteUsers within their User Properties
- you could use Accept instead of ClientAuth and define the RemoteAccess Community within the VPN tab of the related rule (see examples in demo mode) Example: lockdown@svr1 svr1 RemoteAccess RemoteDesktop Accept Log

Best regards,
Danny Trommer
CCSA/CCSE/CCSE+

[slash85]

Top man,

I'll try the suggested.

Many thanks,
Slash.

[mcnallym]

Why using Client Auth with a Remote Access VPN, surely should be Client Encrypt action if traditional mode, or specify the Remote Access VPN and Accept if Simplified Mode.

Is the user a member of another user group that would have access to the whole network still.

[slash85]

Hi,

When i try the above the policy fails to install with error:

User Groups are allowed only on Authentication Rules

Any ideas?

I've got this in the rulebase:

10: lockdown@svr1 svr1 RemoteAccess RemoteDesktop Accept Log
11: lockdown@svr1 any any traffic any drop log

Thanks for any help

Slash.

[mcnallym]

I would suggest that the problem is in Rule 11

Set the 3rd coloumn, VPN to be Remote Access.

[slash85]

Thanks for the respone but now the policy install fails with:

action can be only Accept when the "VPN" includes SR Communities objects

Any more idea?

Slash.

[mcnallym]

Try disabling Rule 11. I do not believe that you will need it.

[Danielpb]

You could try using IP pools and try and restrict access that way.
But i could be wrong on that as I've never tested it.

But from what I can see your rules it looks fine other than the ClientAuth this should be Cleint Encrypt as mcnallym says.