Firewall - Check Point

UserAuthority Server14. When running SSL Network Extender on IPSO, the SSL Network Extender serverwill not start if the Voyager port is set to its default value of 443. The solution is tomove the Voyager server to another port.UserAuthority Server1. When using UserAuthority Server on Citrix/Terminal Server, routing configurationswhere a destination can be reached through multiple interfaces using the samemetric is not supported. The Citrix UAS identifies connections by a 4-tuple: sourceport, destination IP and destination port. The source IP address is not taken intoaccount. As a result the Citrix UAS cannot differentiate between concurrentconnections that differ by their source IP addresses only. In the following example,if the two connections are opened simultaneously, the UAS cannot guarantee thatthe right user identification will be returned for queries on those connections.User Source IP Source Port Destination IP Destination PortJoe 192.168.0.5 5001 10.1.1.2 80Bob 192.168.0.2 5001 10.1.1.2 802. When changing Trusted Domains (under Global Properties > UserAuthority) fromSpecific Domains to All Domains, some users may need to be redefined without the“DOMAIN\” prefix.3. When using a Log Server, a security rule which allows ELA traffic from theUserAuthority Server to this Log Server should be explicitly defined.4. UserAuthority Server is supported on single processor machines only. RunningUserAuthority Server on SMP may cause instability in the VPN-1 Pro kernel.5. When users are authenticated on other VPN-1 Pro Gateways using ClientAuthentication, SecureClient or SecuRemote, the automatic configuration is unableto resolve the connection to the username. This configuration can be done inmanual configuration, with the following settings: the VPN-1 Pro Gateway should bein a VPN-1 Pro/Express Gateway group, and the check box of the Windows DomainControllers field should be checked.6. The option to share identities with a VPN endpoint when VPN is established isunavailable. Chaining to another VPN-1 Pro Gateway can be done only in the clear.Enterprise Suite NGX R61 Known Limitations Supplement Last Update — February 7, 2007 50