i suppose you want to use secureremote or secureclient, so you have to create a user-database and a secureclient-remote user group, and a rule to permit acces from outside after authentication procedure.

create a usergroup, check for sc/sr license (sr is free and you can create license from www.checkpoint) and create 2 rules with:

first rule

source: any

destination: firewall object

service: fw1_topo;ike udp;ike tcp

action: accept

second rule

source: secure-remote user group

destination: the servers(or network) you want to use/browse from outside

service: the services that servers-group need to use to access them

action: client encrypt(both intersect with database)

on global properties check on remote access->encrypt dns traffic

after check on vpn basic the ike over tcp and pre-shared secret if you want to use a password, i suggest you a certificates.

and in vpn advanced enforce encryption algorithm to all users.

i hope this can help you.

ciao

Raoul Ferro

Ok, for the second rule, I don't have the option Client Encrypt, I have Client Authenticate.  Which I chose to use. However, I'm still having the same problem. I've always been able to authenticate and get connected and at least see our domain. I can see the connection packets in the log files pass through the firewall and the external DNS server.  What I can't do is see the Windows 2000 servers I need to hit.  I can see the packets being dropped in the log by the (any any rule) when they try to pass through the internal DNS servers.  I added the internal DNS servers to the Destination column, but no luck.  Suggestions anyone?