Check Point Vpn-1/Securemote/Secureclient Version 4.1 SP2 ...

SecuRemote/SecureClient
Assume the service name is “CP_IPSec_transport_encapsulation”. To define it, add the set
isakmp.udpencapsulation to the gateway object in the objects.C file on the VPN-1/SecuRemote/
SecureClient Management Station as follows:
:isakmp.udpencapsulation (
:resource (
:type (refobj)
:refname (“#_CP_IPSec_transport_encapsulation”)
)
:active (true)
)
■ To disable UDP encapsulation, configure the VPN-1/SecuRemote/SecureClient gateway by adding the
set isakmp.udpencapsulation with the attribute :active (false) to the gateway object in the
objects.C file.
Warning – Make sure you observe the following basic rules for configuring the objects.C file:
■ The objects.C file should be configured on the VPN-1/SecuRemote/SecureClient Management
Station only.
■ Before configuring the objects.C file, stop the Management Station using the fwstop command
and delete the files objects.C.sav and objects.C.bak.
■ The changes made in the objects.C file take effect only after the Security Policy has been
installed.
Warning – Please note the following:
If UDP encapsulation mode is used (to convey IPsec traffic from a SecuRemote or SecureClient to a
VPN-1 gateway through a machine that performs NAT), make sure that:
■ The primary gateway’s IP address is the one closest to the SecuRemote client (that is, the external IP
address).
■ The user’s IKE Data Integrity method is SHA1 (the default). This parameter is defined in the
Encryption tab of the user’s IKE Properties window, which can be accessed by editing the IKE Client
Encryption Method in the Encryption tab of the user’s User Properties window.
2 Branding — It is possible to “brand” the SecuRemote authentication dialog boxes, in two ways:
■ Add a custom bitmap, which will be displayed in the empty space on the left side of the dialog box
■ Add text that will be shown when authentication ends (with different texts for success and failure).
To use this feature, proceed as follows:
a. Overwrite logo.bmp on the installation package with the required bitmap (maximum 140 x 111 pixels:
width times height).
b. Edit the AuthMsg.txt file and insert the required authentication success/failure messages as described
in the file.
c. Edit the product.ini file and set “IncludeBrandingFiles=1”.
To disable the custom message feature, edit the “:options” setting in userc.c, and add:
:use_ext_auth_msg (false)
For your convenience, RGB (192, 192, 192) is considered “transparent”. This color will be displayed as the
dialog background color, whatever it is (not necessarily gray). You may take advantage of this to disable the
customized logo feature by providing a (small) transparent bitmap.
PLEASE REVIEW THE LICENSE AGREEMENT BEFORE USING THIS OPTION!
3 Multiple interface resolution for gateways — A gateway’s interfaces may not all be routable from all IP
addresses. Internal interfaces may be routable only from the LAN, and exportable interfaces may be routable
only from the WAN. SecuRemote can be configured to try all of a gateway’s interfaces, in the event that the
interface it should use depends on the client’s location. The connection will be opened with the first address
to reply.
Limitations —
■ This feature applies only to IKE key exchange, not to FWZ, or to topology download (defining or
updating sites).
■ There is no High Availability between interfaces. Therefore, a SecuRemote client which remains at the
same IP address will not be able to switch to another interface if the interface it works with is down.
■ Topology must be downloaded only from the canonical IP.
■ For SecureClient Policy Server (PS) logon, it will work for logon to Policy Servers if:
Logon was “implicit”, that is, the PS logon is triggered by a packet needing encryption, and
2 VPN-1/SecuRemote/SecureClient Version Version 4.1 SP2 - Release Notes