topic Re: Harmony Endpoint and settings Mobile Access in Endpoint

Harmony Endpoint and settings Mobile Access

Corporal307 — Wed, 14 Aug 2024 05:38:14 GMT

Good afternoon Tell me, is it possible to allow remote connection with the Harmony agent only through SCV policies or is there another way? And if we use SCV policies to check the installed Harmony agent on the end device, is it possible to make sure that the first group of users has the Harmony agent checked, and the second group of users have some other checks?

Re: Harmony Endpoint and settings Mobile Access

G_W_Albrecht — Wed, 14 Aug 2024 06:57:07 GMT

https://community.checkpoint.com/t5/Remote-Access-VPN/Limit-the-SCV-policy-to-a-specific-group-of-users/m-p/215038#M10619

Re: Harmony Endpoint and settings Mobile Access

Corporal307 — Wed, 14 Aug 2024 07:05:52 GMT

Thanks for the answer! Is there any information for the first question? Checking your installed Harmony by looking at a registry entry or the name of a running application is not at all safe.

Re: Harmony Endpoint and settings Mobile Access

G_W_Albrecht — Wed, 14 Aug 2024 07:23:20 GMT

Sorry, but i do not fully comprehend the first question ! I think you are talking about Harmony Endpoint Security VPN client https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/Endpoint-Security-VPN.htm?Highlight=SCV

Here, you do not need to check for the Harmony Version as you have automatic In-Place updates https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/Automatic-Upgrade-from-GW.htm?Highlight=Upgrade

Re: Harmony Endpoint and settings Mobile Access

Corporal307 — Wed, 14 Aug 2024 07:28:09 GMT

The question is, how can I allow VPN connections only through Harmony Endpoint? The only solution I found was to configure Harmony Endpoint presence checking on the end device through SCV policies.

Re: Harmony Endpoint and settings Mobile Access

G_W_Albrecht — Wed, 14 Aug 2024 07:33:30 GMT

You only need to enable EPS VPN alone:

Re: Harmony Endpoint and settings Mobile Access

Corporal307 — Wed, 14 Aug 2024 07:38:40 GMT

In this case, I, as a user, can use Endpoint Secuirty Client VPN. And Harmony Endpoint will not be mandatory for me here. And if I check the presence of Harmony Endpoint through the registry, then I can manually add this entry to the registry and it will still let me through. :(

Re: Harmony Endpoint and settings Mobile Access

G_W_Albrecht — Wed, 14 Aug 2024 07:44:23 GMT

Connection with this option checked is only possible using Endpoint Security VPN client, so it is mandatory to use this client anyway. I do not understand why you need to check the registry ?

Or do you think of Harmony Endpoint client ? That will be unable to connect without EPM active on-site or in cloud.

Re: Harmony Endpoint and settings Mobile Access

Corporal307 — Wed, 14 Aug 2024 07:46:52 GMT

I want users to be able to use the VPN only after Harmony Endpoint confirms that the device is secure. For this, apparently my only option is to use SCV policies to verify that Harmony Endpoint is running on the end device.

Re: Harmony Endpoint and settings Mobile Access

G_W_Albrecht — Wed, 14 Aug 2024 07:54:22 GMT

So you want to use Harmony Endpoint like here: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_HarmonyEndpointWebManagement_AdminGuide/Topics-Common-for-HEP/Access_and_Compliance/Remote_Access_Compliance_Status.html?Highlight=SCV

You will see in the HEP portal the state of the client and not have to use SCV at all (you do not want to look for the latest Win11 update?):

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Harmony-Endpoint-Admin-Guide/Topics-Common-for-HEP-HB/Viewing-Computer-Information.htm?TocPath=Viewing%20Computer%20Information%7C_____0