How to disable the security policy with check point VPN-1 secure client?

Question

To connect to a customers network, I had to install Check point VPN-1 secure client.

Version information:

VPN-1 SecureClient NGX R60 HFA2 (Build001)

The tool block all incoming traffic to my computer. (Which is fine by me as long as I'm connected to the remote site but even if the VPN connection is inactive, my computer cannot be connected to (e.g. for a VNC session of a co-worker within our corporate net).

I have already tried:

• Disable windows firewall (also the service completely)
• disable/stop the Check Point VPN-1 Securemote service + its watchdog service
• (the stuff Paul proposed in his answer, see in the comments there)

I cannot use [Check Point Tray Icon] -> [Tools] -> [Disable Security policy] as that is grayed out.

How can I FULLY disable this thing?

I have full admin access on my machine (how else could I disable my firewall (service!) and the CP Windows service.

This is a Win XP sp3 machine.

To reiterate: I do not mind the tool blocking what it wants while it is active but it also fully blocks inbound connections while it is not active -- even while its Windos Service isn't even running! (Note that the Check Point diagnostic utility does show in its log the dropped inbound packets.)

Another clarification: The tool does not block outgoing traffic, that is I can browse the net, check mails, etc. even while it is active just fine. However it does block all inbound connections (essentially like Windows firewall would do by default, dropping all inbound packets).

I can only assume I've either missed another service of this or it has installed a device driver or root kit of some sorts to enforce its so called security policy while it is not even in use.

Answer 1

Which version of the client is this? Versions later than R65 get increasingly difficult to control the security policy. And The 7x series will block incoming traffic no matter what.

You can do this from the command line with

scc sp off

However, this requires the usersc.c file to be changed, so that it contains:

api_manual_slan_control=true

But this may not work of course. My solution to this is to install the bastid thing into a VM and access it via the console.

Answer 2

I'm working on Windows server and this problem cuts off RDP connections from the users as well. We found the way to disable it anyway.

Hopefully, SecureClient NGX R60 HFA 3 with support for Windows 7 32bit is running okay on Windows server so WinXP should work well.

SecureClient NGX R60 HFA 3 with support for Windows 7 32bit

For "Disabling Security Policy" option, it would be automatically enabled again when you logon VPN network successfully. Well, it can be disabled manually by the command like:

C:/>C:\Program Files\CheckPoint\SecuRemote\bin\scc.exe sp off

Actually, you can automate this by creating a scheduled task to run the above command, say, for every 5 minutes, in order to keep the security policy disabled. The catch is that we need to initiate remote desktop connection to the server which may have SecureClient turned On (also with security policy which blocks RDP connections). This command turns off the security policy and allow RDP user to login remotely.