CPUG

The Check Point User Group

A Resource For The Check Point Community.  Fast.  Useful.  Independent.

1. CCSA/CCSE One-Week Dual-Certification Training Course with CPUG in San Francisco!
    Courses Starting 12/8, (2009) 1/19, 2/9, 3/9, 4/6, 5/4, 6/8, 7/6, 8/3.
2. Join Us On LinkedIn - We now have a CPUG group.


Go Back   CPUG: The Check Point User Group > Web Security > SSL Network Extender
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 2008-06-17
Junior Member
 
Join Date: 2008-03-10
Posts: 4
Rep Power: 0
bytor has an average reputation (10+)
Default SNX not working on R65 ClusterXL

I have a SPLAT 2.6 R65 gateway that (at the moment) is the only member of a ClusterXL. (A 2nd member will be added later.)

I have configured it for SNX as per documention - i have configured it in SmartDashboard and have a SNX license attached to the SCS.

To test SNX I have connected an XP PC onto the same subnet as the external interface.
In the IE browser I enter https://210.x.x.x (Virtual IP of the Cluster external interface).
The connection fails and the browser shows the error message "Cannot find server or DNS Error".
Also I try telnet 210.x.x.x 443 and this also fails.

But, in the SmartView Tracker logs I can see the https/443 traffic in green.
Also, when i do fw monitor –e “accept [12, b]='srcIP' or [16, b]='dstIP';”
It shows the traffic hitting the interface.

Also I do "vpn debug on" and check the vpnd.elg file, there are no SNX license errors there. So it does not seem to be a license problem.

Does anyone have any idea what the problem is please?

Thanks
Reply With Quote
  #2 (permalink)  
Old 2008-06-17
Senior Member
 
Join Date: 2007-07-16
Posts: 618
Rep Power: 2
Thorpuse has an average reputation (10+)
Default Re: SNX not working on R65 ClusterXL

1. Check that the SPLAT WebUI is not using port 443. In the SPLAT gui, type webui disable or webui enable <port> to put it on another port.

2. If you're running NGX with Messaging Security, there's a licensing bug that affect UTM-1 devices, it may affect SPLAT 2.6. Contact CP to verify and/or hotfix.

3. run netstat -na and see if the gateway is listening on port 443.

SNX will work with clusters. I haven't tried it on SPLAT 2.6, but can't imagine why it wouldn't go there.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT -7. The time now is 18:31.


Powered by vBulletin® Version 3.7.4
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.2.0