Cannot Establish Connection to SSL Network Extender

[gt123]

Hello,

I have just finished installing Connectra Version R62. It has a private IP address of 192.168.1.1 on the DMZ. My Checkpoint is natting the external Public IP address to the 192.168.1.1 .

I am having a hard time getting the SSL Network Extender to work. It always says "cannot establish connection to SSL Network Extender gateway. Try to reconnect.

My firewall is allowing ports TCP 444 and 443 incoming to the public IP address.

Under the Nat configuration, I checked off custom ip address and entered the publich ip address but it still does't work.

Any help would be appreciated. Thanks .

[mcnallym]

OK just to clarify this is what you should have.

Connectra is on 192.168.1.1

This is on the DMZ and is NATted via the firewall to a public address lets say 203.203.203.1

On the Check Point firewall then you have a rule as follows

Src = Any Dst = 203.203.203.1 Srv = 443 and 444 Act= Accept

In the NAT you have

Src = Any Dst = 203.203.203.1 xlatesrc = original xlatedst = 192.168.1.1

If you have that then you should be able to access the connectra with snx.

What are you seeing the firewall logs

Silly question but snx is configured on the Connectra for some users.

[gt123]

Yes, that is what I have configured for the Firewall rules to allow incoming from the Internet . I only see https requests when I try to connect using snx.
When I put a workstation on the same segment as the Connectra - 192.168.1.1, it works. I'm suspecting a configuring issue on the Connectra but I've fiddled around with all the settings and almost ready to give up.

Thanks

[Thorpuse]

port conflict on port 443? If your firewall is SecurePlatform (or Nokia) and you're running the WebUI for management, the firewall will be listening on 443 and will not route the packets.

Disable the webUI or move it to a different port.

[gt123]

I got the problem fixed. It was actually the upstream provider that was blocking tcp 444.

Thanks