Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

To connect to a customers network, I had to install Check point VPN-1 secure client.

Version information:

VPN-1 SecureClient NGX R60 HFA2 (Build001)

The tool block all incoming traffic to my computer. (Which is fine by me as long as I'm connected to the remote site but even if the VPN connection is inactive, my computer cannot be connected to (e.g. for a VNC session of a co-worker within our corporate net).

I have already tried:

  • Disable windows firewall (also the service completely)
  • disable/stop the Check Point VPN-1 Securemote service + its watchdog service
  • (the stuff Paul proposed in his answer, see in the comments there)

I cannot use [Check Point Tray Icon] -> [Tools] -> [Disable Security policy] as that is grayed out.

How can I FULLY disable this thing?

I have full admin access on my machine (how else could I disable my firewall (service!) and the CP Windows service.

This is a Win XP sp3 machine.

To reiterate: I do not mind the tool blocking what it wants while it is active but it also fully blocks inbound connections while it is not active -- even while its Windos Service isn't even running! (Note that the Check Point diagnostic utility does show in its log the dropped inbound packets.)

Another clarification: The tool does not block outgoing traffic, that is I can browse the net, check mails, etc. even while it is active just fine. However it does block all inbound connections (essentially like Windows firewall would do by default, dropping all inbound packets).

I can only assume I've either missed another service of this or it has installed a device driver or root kit of some sorts to enforce its so called security policy while it is not even in use.

share|improve this question
    
There's probably a device driver associated with the filter, if you can identify the appropriate driver the sc command line tool may allow you to stop it. Of course not all device drivers can be stopped without rebooting the system. –  Harry Johnston Oct 5 '11 at 21:53
1  
One possible workaround: remove the VPN client and then install it in a virtual machine. The main catch is that depending on how your copy of Windows is licensed you might need to buy an additional license for the VM. :-( –  Harry Johnston Oct 5 '11 at 21:54
    
Isn't there a second service called "Check Point Watchdog" or something similar? Did you try disabling that one, too? –  mich732 Oct 6 '11 at 6:19
    
@mich732 - yes I also disabled that one. didn't mention it. I'll edit. –  Martin Oct 6 '11 at 6:41
    
With your update my answer makes no sense at all, so I deleted it:-) –  Rory Alsop Oct 6 '11 at 8:47
add comment

2 Answers

Which version of the client is this? Versions later than R65 get increasingly difficult to control the security policy. And The 7x series will block incoming traffic no matter what.

You can do this from the command line with

scc sp off

However, this requires the usersc.c file to be changed, so that it contains:

api_manual_slan_control=true

But this may not work of course. My solution to this is to install the bastid thing into a VM and access it via the console.

share|improve this answer
    
Paul - apparently it's version R60 whatnot –  Martin Oct 6 '11 at 5:39
    
Sadly: C:\Programme\CheckPoint\SecuRemote\bin>scc sp off -> Failed to disable policy –  Martin Oct 6 '11 at 5:43
    
Oh my: in C:\Programme\CheckPoint\SecuRemote\database\userc.C I have now changed it to :api_manual_slan_control (true) (it was false) and rebooted the PC -- no luck: Option in Tray menu is still grayed out and on the commandline I also still get Failed to disable policy –  Martin Oct 6 '11 at 5:59
add comment

I'm working on Windows server and this problem cuts off RDP connections from the users as well. We found the way to disable it anyway.

Hopefully, SecureClient NGX R60 HFA 3 with support for Windows 7 32bit is running okay on Windows server so WinXP should work well.

SecureClient NGX R60 HFA 3 with support for Windows 7 32bit

For "Disabling Security Policy" option, it would be automatically enabled again when you logon VPN network successfully. Well, it can be disabled manually by the command like:

C:/>C:\Program Files\CheckPoint\SecuRemote\bin\scc.exe sp off

Actually, you can automate this by creating a scheduled task to run the above command, say, for every 5 minutes, in order to keep the security policy disabled. The catch is that we need to initiate remote desktop connection to the server which may have SecureClient turned On (also with security policy which blocks RDP connections). This command turns off the security policy and allow RDP user to login remotely.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.