Browsing the Network Neighborhood with Secure Client

[BarryStiefel]

Browsing the Network Neighborhood with Secure Client



To ensure that NetBIOS Name Resolution happens correctly, you will need either a WINS server on your internal network. A well-populated LMHOSTS file containing names of all your NetBIOS-capable systems will also work for the purposes of connecting to a specific host by NetBIOS?, but the "Network Neighborhood" functionality requires WINS.

Your SecuRemote client will need to be configured to use this WINS server for name resolution. This is done on the adaptor used by the client to connect to the encryption domain. If using Dial-up Networking, it needs to be configured in the Dial-Up Networking profile you use to connect to the Internet. Also make sure that "Client for Windows Networks" is enabled in your dialup profile in Windows 2000. If your internal network uses illegal or private network addresses, you will need to use the "Encapsulate SecuRemote Connections" option in the encryption tab of the Firewall object if using FWZ or use IKE for this to work.

An alternative to the above is to implement Office Mode (available in NG FP2 and lateR). Office Mode allows you to assign IP addresses to clients as well as WINS/DNS information.

On Windows 2000, if using a modem dialup, make sure the profile is configured to enable "Client for Microsoft Networks," as it is disabled by default. You should also prevent your Windows 2000 system from becoming the master browser by modifying the following registry entry to "False" via regedit: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Browser\Parameters\MaintainServerList

If you also wish to log into an NT domain, which may be necessary to browse the Network Neighborhood in some cases, see: Logging to an NT Domain via Secure Client

Also, make sure your WINS server is not subject to any address translation as this will also cause an issue, or at least make sure the NBT group of services is not subject to NAT

-- PhoneBoy - 11 Apr 2004

FAQForm FAQs.Class: SecureClientFAQs FAQs.OS: FAQs.Version:

[deedje]

I'm not agree with you :
"[..] the "Network Neighborhood" functionality requires WINS."

If you plug 2 windows laptops together with a cross cable, you'll see each other in the network neighborhood list. No WINS required. Just many NBT annoucment.

BUT if you have secureclient installed, this feature doesn't work anymore ; You ONLY can reenable this feature by disabling (means deactivating) the adapter ("local area network connection" properties > Check Point SecuRemote)

Question : do you have any idea how to deactivate this SecureClient Properties ?

[panky]

Hi,
I agree with deedje as I am facing the same problem. I am working on a win2k domain and some of my clients are installed with SecureClient and these are not able to browse the network however they can access the machines with an IP address. Whereas all other machines can browse the network. If I uncheck the checkpoint drivers frm the cleint machine they can access the network. Can any one help me out.
Thanks

[chillyjim]

Originally Posted by deedje

I'm not agree with you :
"[..] the "Network Neighborhood" functionality requires WINS."

If you plug 2 windows laptops together with a cross cable, you'll see each other in the network neighborhood list. No WINS required. Just many NBT annoucment.

The NBT announcement is a broadcast so it won't cross a router (or a firewall), thus the need for WINS.

The answer from M$ BTW is don't depend on browsing to work over any VPN connection. It seems to with WINS most of the time though.

[captclam]

Could someone please clarify for me why setting the DNS server address on the IP stack to an internal server would not correct this problem?

[chillyjim]

Originally Posted by captclam

Could someone please clarify for me why setting the DNS server address on the IP stack to an internal server would not correct this problem?

Browsing is not based on DNS, its a broadcast technology. To support routed connections, MS developed WINS (Think of it as DNS for NetBIOS).