topic Re: Remote-Access VPN Office Mode with Endpoint Security VPN Client in Endpoint

Remote-Access VPN Office Mode with Endpoint Security VPN Client

CyberBreaker — Wed, 15 Apr 2020 07:32:10 GMT

Hi, do I need additional license if I am using office mode with endpoint security VPN client for my remote access VPN solution (IPSec protocol)? What I noticed when I installed the license below, some of my users were not able to get an office mode IP address.

CPAP-SG560X CPSB-FW CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSB-IPS CPSB-URLF CPSB-APCL CPSB-AV CPSB-ABOT-M CPSB-ASPM CPSB-CTNT

Thanks

Re: Remote-Access VPN Office Mode with Endpoint Security VPN Client

Danny — Wed, 15 Apr 2020 09:02:23 GMT

You can check your VPN statistics with this tool: SmartConsole Extension for VPN Statistics

Re: Remote-Access VPN Office Mode with Endpoint Security VPN Client

AndreiR — Wed, 15 Apr 2020 16:48:34 GMT

@CyberBreaker ,

To get OM IPs you should use CPSB-MOB license. It can be for 50, 200 or unlimited number of users. Every security gateway allows 5 users by default which means you likely get into the case when 5 users are good but the 6th and further can't connect because of no license.

Re: Remote-Access VPN Office Mode with Endpoint Security VPN Client

CyberBreaker — Wed, 15 Apr 2020 16:59:47 GMT

Hi @AndreiR ,

I am bit confused now, your TAC told me that it is because of this license CPSB-SSLVPN-5 then you told me it is CPSB-MOB, which should it be? Thanks for clarifying.

But it is not necessary that I need to enable the Mobile Access blade right? Just IPSec blade is enough, correct? I am just using Endpoint Security VPN with IPSec tunnel as its protocol for my remote access VPN.

Thanks

Re: Remote-Access VPN Office Mode with Endpoint Security VPN Client

PhoneBoy — Wed, 15 Apr 2020 17:32:07 GMT

You either need Mobile Access licenses (CPSB-SSLVPN and/or CPSB-MOB) which is counted by concurrent connections OR Endpoint licenses (either SBA or ACCESS) which is licensed per installed host.
Either will work and enable Office Mode for your users.
Mobile Access Blade does not need to be enabled.
See: https://community.checkpoint.com/t5/Remote-Access-Solutions/Remote-Access-VPN-Short-List-of-Most-Useful-Resources-and-Tools/m-p/78983#M2935
While you work out which option is best for your situation with your Check Point partner, apply an All-in-one Eval to your gateway.