topic Re: Disable SSL Network Extender in Firewall and Security Management

Disable SSL Network Extender

aharihara — Tue, 29 Sep 2020 10:29:00 GMT

Dear Checkmates,

One of my customer wants to disable SSL Network Extender feature but still still want to have the remote access VPN solution. I tried the solution given in the below URL. It didn't work

https://community.checkpoint.com/t5/General-Topics/Allow-Portal-URL-only-for-Mobile-Access/m-p/29381#M5999

Then I tried to disable the visitor mode , but then it also disabled the Remote Access VPN connectivity. The management server is running in R80.10 and the gateways are in R76.

Can someone guide me how I can acheive this .

Re: Disable SSL Network Extender

G_W_Albrecht — Tue, 29 Sep 2020 11:12:04 GMT

You can do this in GW object and select only the types of clients you need:

But BTW - R76 is out of support since February 2017...

Re: Disable SSL Network Extender

aharihara — Thu, 01 Oct 2020 10:58:22 GMT

Thanks for the reply, I tried this solution, but still we were able to access the SSL Network Extender. I then discovered a workaround by changing the authentication method(in Global Properties) to certificates, which indeed made the SNX URL to be unusable since there is no certificate. This is not a solution, just a workaround.

I agree with you on the R76 version, I already told the customer to plan for the upgrade.

Re: Disable SSL Network Extender

G_W_Albrecht — Thu, 01 Oct 2020 13:53:37 GMT

Is the MAB Portal running ? That would explain why SNX still works.

Re: Disable SSL Network Extender

aharihara — Thu, 01 Oct 2020 13:58:08 GMT

I'm not sure, if the MAB is running, but I'm sure I didn't see the Mobile Access option in the Gateway properties. I can confirm this when I connect with the customer next time, probably in a week's time.

Also, they are using Checkpoint Endpoint Security Client to connect to VPN.