Securemote Internet traffic through firewall

[lynx]

Our CheckPoint VPN-1 firewall provides VPN network access to Securemote clients. These clients (staff using Win98 and Win 95 notebooks) dial-up an ISP account to start the connection.

The process of authentification to the firewall works fine and they successsfully access any shared resource.

The problem is the path that the connection to the Internet in these notebooks follows. When they are connected to the ISP, all web trafic is routed by the ISP; our firewall is unawared of these connections. This also means that, if the authentification to the firewall fails or is overlooked on purpose, users still can surf the net.

We want to route users Internet traffic through the VPN-1 firewall and, that way, record it in the Log Viewer. Can any of you help me to solve this problem?

The properties of TCP/IP--FW1 protocol are setup to look for our internal DNS, WINS, and Gateways servers. The properties of the dial-up connection to the ISP also have the TCP/IP settings with the IP addresses of DNS and WINS servers.

The Internet Explorer connection settings are LAN based. We don't use a proxy.

I found an advice in a web site that suggested to change the Desktop Security (Properties of Policy Editor) to 'Allow encrypted only' but this didn't give any results.

Does any of you have similar experience? Do you know how to solve it?

Thanks a lot,

 

[Guest_imported]

Hi I'm not sure just how helpfull this is but here we go.....
Firstly you need to install SecureRemote client so that it is bound to both the dialup and the ethernet adaptor, so that when the SecurRemote client is running it is protecting all your network interfaces, then you control the traffic via the Policy server with rules accordingly.

After that you need a client like "iPass", which can be configured so that when you dial into the ISP and connect it starts your SecurRemote client and can not be switched off (You control this with the Setup.ini at install time, you can remove start stop buttons/menu selections etc)) You can switch things on and off this way so the users have no control over it other then to log on to the required site and download policy. Once the policy is downloaded users have access to network. SecurRemote also has default policy which will protect notebook when user is not loged on to site.

Cheers
Solargeek

 

[Guest_imported]

You could lookup Checkpoints document on split/encryted DNS but just implement the encryted DNS only by creating the $FWDIR/conf/dnsinfo.C file and populating it with:-
(
:encrypt_dns (true)
)
Then all DNS traffic will be encrypted to your internal DNS servers and it will not be possible to resolve dns using public DNS servers as long as SecuRemote is running.
Paul

 

[rstockton]

Would you not also have trouble routing web traffic back in an out of the external interface of the firewall? Would you need to have 2 inet pipes in and out of the firewall to do this?