topic Re: Secure user access to out of band firewall in SASE and Remote Access

Secure user access to out of band firewall

peter_schumache — Thu, 06 Feb 2020 09:49:38 GMT

We have a 1550 firewall in front of some out of band switches. We want a secure access to these OOB equipment in case of a disater. Mobile access blade is NOT supported by the 1550 models, just the IPSec VPN.

What szenarios would be possible here? I'm considering the following:

Site-to-Site VPN to the azure cloud, which holds a jump host accessible from the Internet
Access rule for ssh and/or https with user authentication (2 factor)
Some Windows 10 client which requires no mobile access license

Re: Secure user access to out of band firewall

PhoneBoy — Fri, 07 Feb 2020 09:20:58 GMT

You can still use the SNX client with the 1550, just not the MAB portal.

Re: Secure user access to out of band firewall

peter_schumache — Wed, 12 Feb 2020 16:02:30 GMT

When I'm trying to connect from my Windows Client to the Gateway using https://<external-ip-of-gwy>/sslvpn

I get the following error: ERR_EMPTY_RESPONSE

What did I miss / Can I check else?

Re: Secure user access to out of band firewall

peter_schumache — Tue, 25 Feb 2020 10:48:09 GMT

How exactly would I use/configure the SNX on the 1550?

Re: Secure user access to out of band firewall

PhoneBoy — Tue, 25 Feb 2020 16:01:28 GMT

To enable SNX, go to VPN > Remote Access > Blade Control.
Make sure SSL VPN is checked and click Apply.
If you click the "How to connect" link, you will be pointed to access https://external-ip:4433
This will bring you to a web page where you can download the SNX client.

Re: Secure user access to out of band firewall

peter_schumache — Tue, 25 Feb 2020 16:58:26 GMT

I've trouble finding the VPN> Remote Access > Blade Control > SSL VPN setting.
Where is it? On the VPN Gateway or in global properties? Or somewhere else?

Re: Secure user access to out of band firewall

PhoneBoy — Tue, 25 Feb 2020 18:38:09 GMT

On the WebUI of the 1550.
I initially checked on my 750, but confirmed this should also exist on the 1550 as well.

Re: Secure user access to out of band firewall

peter_schumache — Wed, 26 Feb 2020 06:51:06 GMT

Since the 1550 is centrally managed, the above options don't work.
From the Security Dashboard in teh WebUI, I can see all possible blades, but I can't modify any of the settings

Re: Secure user access to out of band firewall

G_W_Albrecht — Wed, 26 Feb 2020 07:59:32 GMT

So please configure it in Dashboard 8)...

Re: Secure user access to out of band firewall

PhoneBoy — Wed, 26 Feb 2020 18:36:08 GMT

For a centrally managed SMB appliance, you would enable access for Check Point Mobile/SNX as part of the Remote Access configuration.
I believe the portal I referred you to (e.g. https://external-ip:4433) will still be how the clients download the SNX client.