topic Client VPN license in Checkpoint in General Topics

Client VPN license in Checkpoint

LostBoY — Tue, 25 Jul 2023 09:51:54 GMT

I have CPSB-VPN blade license on my AWS Checkpoint Gatways. I am looking to enable Remote access VPN for a few clients.

My query is do i require additional license for this ? i read about Securemote which requires only CPSB-VPN blade but the kb states that it has limited functionality.. what are its limitations ?

Re: Client VPN license in Checkpoint

Chris_Atkinson — Tue, 25 Jul 2023 10:04:24 GMT

In terms of primary limitations Securemote doesn't support office mode.

Depending on the license many gateway SKUs allow 5 mobile access connections by default.

Re: Client VPN license in Checkpoint

LostBoY — Tue, 25 Jul 2023 10:51:39 GMT

Office mode affects only DNS and WINS ? does still assigns an IP address from a defined pool ? my requirement is only to give RDP access to a jump box.

Also is there a remote vpn configuration limitation for Checkpoint Cloudguard ?

Re: Client VPN license in Checkpoint

Chris_Atkinson — Tue, 25 Jul 2023 11:49:48 GMT

Yes it impacts VPN IP assignment flexibility

Some templates don't support VPN, specifically with VMSS for Azure the SecuRemote flavor is not supported.

Source: https://sc1.checkpoint.com/documents/iaas/webadminguides/en/cp_vmss_for_azure/content/topics-azure-vmss/known-limitations.htm

Re: Client VPN license in Checkpoint

LostBoY — Tue, 25 Jul 2023 12:30:34 GMT

i am using AWS Cloudguard and i read somewhere that VPN wasnt supported on R80.40 cloudguard but was introduced from R81 onwards...unfortunately i cudnt find that link.

I was trying to test Securemote but when i try to enable ipsec vpn blade policy installation fails

Re: Client VPN license in Checkpoint

G_W_Albrecht — Tue, 25 Jul 2023 13:13:13 GMT

SecuRemote will not use the OM IP pool for IP assignement but needs the firewall to be configured to let the original client IP connect and access. So this is only an alternative if the RA client has a static IP.

Re: Client VPN license in Checkpoint

Chris_Atkinson — Tue, 25 Jul 2023 14:35:23 GMT

For AWS Remote Access isn't supported for auto-scale deployments, what scenario have you deployed?

https://sc1.checkpoint.com/documents/iaas/webadminguides/en/cloudguard_network_for_aws_autoscaling_deploymentguide/topics-aws-autoscale-dg/limitations.htm#Limitations

Re: Client VPN license in Checkpoint

LostBoY — Tue, 25 Jul 2023 14:54:54 GMT

it is a cross availability zone cluster on R81.20

Re: Client VPN license in Checkpoint

Chris_Atkinson — Tue, 25 Jul 2023 15:35:28 GMT

In such cases Site-to-Site and Remote Access VPN are supported only with the Primary Elastic IP (VIP). You cannot use additional Elastic IP's for VPN.

Re: Client VPN license in Checkpoint

LostBoY — Tue, 25 Jul 2023 16:24:07 GMT

i suppose that will be fine in my case...

However after enabling ipsec vpn blade on GW policy installation is failing 😞

Re: Client VPN license in Checkpoint

PhoneBoy — Tue, 25 Jul 2023 20:19:00 GMT

Screenshot of the precise error?
Blur sensitive details.

Re: Client VPN license in Checkpoint

LostBoY — Wed, 26 Jul 2023 10:08:53 GMT

It just says operation ended with errors , no error message detail available

Re: Client VPN license in Checkpoint

PhoneBoy — Wed, 26 Jul 2023 13:38:09 GMT

Did you click on the specific lines where it said failed?
It should show details why it failed.
If not, you should involve the TAC: https://help.checkpoint.com

Re: Client VPN license in Checkpoint

the_rock — Wed, 26 Jul 2023 13:50:30 GMT

If you expand the reason why it failed, as the guys indicated, would tell us the reason. Please blur out any sensitive info mate.

Andy

Re: Client VPN license in Checkpoint

LostBoY — Thu, 27 Jul 2023 09:35:59 GMT

unfortunately there is no reason defined and no expansion available there

Re: Client VPN license in Checkpoint

the_rock — Thu, 27 Jul 2023 12:06:46 GMT

I find that odd, sorry...there has to be some kind of wording as to why its failing. If you expand the down arrow where it fails, can you send a screenshot please?

Andy

Re: Client VPN license in Checkpoint

LostBoY — Thu, 27 Jul 2023 12:24:24 GMT

OK so i resolved the issue.. the thing was this was a geocluster with 0.0.0.0 as its cluster IP. However, the VPN blade requires a legit Cluster IP to function as soon as i replaced it policy installation was successfull.

Re: Client VPN license in Checkpoint

the_rock — Thu, 27 Jul 2023 12:36:05 GMT

Great job mate, tx for sharing!