Troubleshoot the Check Point integration
Troubleshoot the Check Point integration.
VPN connections are good, but you are unable to connect to the web server in the private network.
- Network routing for the web server
Ensure the VPN communities setting contains this private network.
If you get an unauthorized user error message, check the policy and also verify the RADIUS group setting, and the group attribute.
In freeRADIUS, you can use tcpdump to check if the group attribute number matches with Check Point (default 25).
If you are using Windows, you can use Wireshark to capture packets.
For example:$sudo tcpdump -i eth0 port 1812 or port 1813 or port 3799 -vv … Access-Accept…… Class Attribute (25)<------(here, RADIUS returned the group using attribute number 25)To check Check Point RADIUS group attribute values:
- Open GuiDBedit.
- Click Global Properties, firewall_properties.
- Scroll to radius_groups_attr.