topic Mobile Access isssues CRM in SASE and Remote Access

Mobile Access isssues CRM

charcris — Thu, 26 Mar 2020 15:03:10 GMT

good morning
I don't know if this problem happened to someone, when implementing mobile access and entering the web page of an RCM server (web application).
there is a problem in all the pages that use ajax showing the following problem,

This is a checkpoint problem because everything works locally, and using vpn remote access (vpn agent) the same.

the logs are showing traffic allowed, there are no drops, in the configuration of the web application, I have activated the sso and http and http services, using the server object

it's a legacy implementation

Could someone give me a hint about the problem, that I don't really know what I'm looking for or that it could be happening please.

Re: Mobile Access isssues CRM

Gaurav_Pandya — Thu, 26 Mar 2020 15:42:32 GMT

Looks like your web application also uses some other service/port to fetch information from database or any other server.

Please check output of netstat -a on working machine and verify that any additional service or IP is there.

Re: Mobile Access isssues CRM

charcris — Thu, 26 Mar 2020 22:13:40 GMT

thanks for reply Gaurav

I do not have access to the crm server, but I could see the policy rules that are used with the CRM server on the local network (it works locally).
I copied the same rules of services and host of origin and destinations involved in CRM server(smartconsole), in the policy of mobile access (smartdashboard), but with the same result (ajax error), I don't know if that would be enough to discard the permissions? or if there is some other way to test the services that the server can use, without entering the CRM server?

Re: Mobile Access isssues CRM

PhoneBoy — Fri, 27 Mar 2020 03:54:24 GMT

When you're using websites through MAB portal, lots of sometimes complex Javascript/AJAX is getting rewritten on the fly.
While we've worked out how to do this and support it for some common apps like Outlook Web Access, it definitely doesn't work for every web application.
For these sorts of web apps, your best bet is to make them available via SNX, which will use a VPN client to tunnel the traffic to the server directly.

Re: Mobile Access isssues CRM

charcris — Fri, 27 Mar 2020 05:54:16 GMT

Thank you very much for answering PhoneBoy,

So this type of scripts is one of the limitations of web applications using the MAB PORTAL.

ok, if it can't be done that way, i will use native apps, thanks a lot for your help and time.

Would there be a document at checkpoint that mentions this limitation?

Re: Mobile Access isssues CRM

PhoneBoy — Fri, 27 Mar 2020 06:09:56 GMT

There is a brief description of this in the product documentation.
It speaks in general terms in the description about the kinds of Web Applications that work:

A Web application can be defined as a set of URLs that are used in the same context and are accessed via a Web browser, for example, inventory management or human resource management.
Mobile Access supports browsing to websites that use HTML and JavaScript.
Browsing to websites with VBScript, Java, or Flash elements that contain embedded links is supported using SSL Network Extender, by defining the application as a native application.
Additionally, some sites will only work through a default browser, and therefore cannot be defined as a Web application. If that is the case, use a native application.

There are also some other features that may help as well.