FireWall-1 FAQ: Securemote and the Network Neighborhood
Please note: This content was from when I was operating my FireWall-1 FAQ site, which I stopped operating in August 2005. For some reason people still have links to this stuff on the Internet that people are still clicking on.
I am making this information available again AS IS. Given how old this information is, it is likely wildly inaccurate. I have no plans to update this information.
If you're still running versions of Check Point VPN-1/FireWall-1 where this information is still relevant to you, do yourself a favor and upgrade to a more recent release. If you happen to be running a current release and the information is useful, it's by happenstance :)
To ensure that NetBIOS Name Resolution happens correctly, you will need either a WINS server on your internal network. A well-populated LMHOSTS file containing names of all your NetBIOS-capable systems will also work for the purposes of connecting to a specific host by NetBIOS, but the “Network Neighborhood” functionality requires WINS.
Your SecuRemote client will need to be configured to use this WINS server for name resolution. This is done on the adaptor used by the client to connect to the encryption domain. If using Dial-up Networking, it needs to be configured in the Dial-Up Networking profile you use to connect to the Internet. Also make sure that “Client for Windows Networks” is enabled in your dialup profile in Windows 2000. If your internal network uses illegal or private network addresses, you will need to use the “Encapsulate SecuRemote Connections” option in the encryption tab of the Firewall object if using FWZ or use IKE for this to work.
An alternative to the above is to implement Office Mode (available in NG FP2 and lateR). Office Mode allows you to assign IP addresses to clients as well as WINS/DNS information.
On Windows 2000, if using a modem dialup, make sure the profile is configured to enable “Client for Microsoft Networks,” as it is disabled by default. You should also prevent your Windows 2000 system from becoming the master browser by modifying the following registry entry to “False” via regedit: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\MaintainServerList
If you also wish to log into an NT domain, which may be necessary to browse the Network Neighborhood in some cases, see: Logging to an NT Domain via Secure Client
Also, make sure your WINS server is not subject to any address translation as this will also cause an issue, or at least make sure the NBT group of services is not subject to NAT
