topic Re: vpnconfig alternative in Endpoint

vpnconfig alternative

loic_76 — Sun, 17 Nov 2024 10:56:33 GMT

Since my new job (a few years ago), my company used to create pre-configured Endpoint Security packages with trac.config (an encrypted file that contains the VPN site config) included using AdminMode.bat.

Then we migrated to managed VPN clients by using SmartEndpoint (because of the firewall included)

Then we had to use vpnconfig (https://support.checkpoint.com/results/sk/sk122574) because we also edited trac.defaults file

But it was a difficult task to provide a new VPN client because of the steps amount:

Generate a package from SmartEndpoint
Install it (to generate trac.defaults new version)
Connect one time (to generate trac.config)
Change several settings in trac.defaults and get trac.config
Use vpnconfig to create a new msi
Uninstall Endpoint Security
Install the newly vpnconfig generated msi to verify everything works as expected.

The main goal of the script I developed is to re-create a vpnconfig alternative that can automate all steps. Dynamic packages are also managed by this script (because since they upgraded the antimalware blade, now the MSI minimum size is 900MB...). Dynamic packages are also minimized to remove useless things, if like us, you only use VPN and firewall (with the script I generate a 100MB VPN client).

The script needs to be configured with json files. Don't forget to edit all json files as the files in the input folder are examples.

The whole project is here: https://github.com/qqt-lo4/CheckPoint_CustomizePackage

Documentation here: https://github.com/qqt-lo4/CheckPoint_CustomizePackage/blob/main/DOC.md

Regards,

Loïc

Re: vpnconfig alternative

_Val_ — Mon, 07 Oct 2024 12:11:16 GMT

Looks like a nice addition to our ToolBox. I will contact you directly to process it.

Re: vpnconfig alternative

loic_76 — Sat, 16 Nov 2024 12:52:39 GMT

New release of the script (version 2.2)

Changed :

- selecting the right file (EPS.msi or install.exe) was not working

- a 2.1 version was not using the good sfxConfig.txt

- EXE extraction is done on a temp subdirectory which change each time

- output folder contains now selectedBlades (if dynamic package is selected)

Added :

- now you can download a package from your management server using this script

- opening file explorer at the end of package generation

Regards,

Loïc Ade

Re: vpnconfig alternative

the_rock — Sat, 16 Nov 2024 14:04:50 GMT

Super interesting...I will forward this to my colleague that used such utility in the past I believe.

Thank you!

Andy

Re: vpnconfig alternative

PhoneBoy — Tue, 24 Dec 2024 23:47:01 GMT

@_Val_ this probably should be in Toolbox

Re: vpnconfig alternative

_Val_ — Fri, 03 Jan 2025 11:41:09 GMT

I am waiting for the author to make minor changes, before moving, @PhoneBoy