topic Re: Check Point Endpoint Security VPN Service only on company-owned devices in SASE and Remote Access

Check Point Endpoint Security VPN Service only on company-owned devices

Pierre_Bienaime — Tue, 26 Nov 2019 20:50:54 GMT

Hi Fellow Checkmate Members

Can anyone help me in achieving this for my company pretty please

Scenario:

We are using "Check Point Endpoint Security" as a remote access client for VPN users. It is working great with no problem. We are currently "Username+Password" as an authentication mechanism. The problem we are having is the following:

Users can install the client on their own personal devices and connect to the VPN because they are allowed to. Now we want to limit Remove Access VPN connection ONLY using company-owned or company-assigned devices to the user. How do I go about achieving that? We are trying to prevent users from installing the Check Point Endpoint Security client to their personal devices, while not removing their Remote access VPN right on company-owned devices. Please help 😔

Re: Check Point Endpoint Security VPN Service only on company-owned devices

PhoneBoy — Wed, 27 Nov 2019 05:36:09 GMT

This is the kind of thing Endpoint Compliance should solve.
A thread that discusses this is here: https://community.checkpoint.com/t5/Remote-Access-Solutions/Restricting-access-to-corporate-devices/m-p/50250
You can also achieve something similar with SCV.
See: https://community.checkpoint.com/t5/Remote-Access-Solutions/White-Paper-Check-Point-Compliance-Checking-with-Secure/m-p/57123

Re: Check Point Endpoint Security VPN Service only on company-owned devices

Chris_Atkinson — Wed, 27 Nov 2019 11:14:01 GMT

R80.40 may yield a feature of interest...

Remote Access VPN

Use machine certificate to distinguish between corporate and non-corporate assets and to set a policy enforcing the use of corporate assets only. Enforcement can be pre-logon (device authentication only) or post-logon (device and user authentication).

Re: Check Point Endpoint Security VPN Service only on company-owned devices

Tommy_Forrest — Wed, 27 Nov 2019 12:36:56 GMT

Change your authentication method so that it is Username+Password+Certificate and only agree to allow them to register a corporate device with the generated Certificate.

While it isn't impossible to export certificates off of a Windows box, it takes some work to get it done and is beyond the capabilities of most users.

Re: Check Point Endpoint Security VPN Service only on company-owned devices

Pierre_Bienaime — Wed, 27 Nov 2019 16:37:33 GMT

Hi Tommy ,
That is the route that I am currently exploring. I see that you have mentioned the Registration of a Corporate device. I am not familiar with how to process will go after enabling the use of "Username+Password+Certificate" on my perimeter Gateways. I do not have a sandbox environment to try, and I want a clear path as to what would follow to complete the process after enabling the setting. I am glad you have mentioned this process, and if I can get a follow up on that, it will be great, thank you in advance

Re: Check Point Endpoint Security VPN Service only on company-owned devices

Pierre_Bienaime — Wed, 27 Nov 2019 16:40:01 GMT

Thank you Chris,
This is the path that I am intending to take, but I want to know how to I go about the certificate registration process

Re: Check Point Endpoint Security VPN Service only on company-owned devices

Pierre_Bienaime — Wed, 27 Nov 2019 16:41:44 GMT

That is a very good approach PhoneBoy thank you. I will dive through the links to have a deeper understanding

Re: Check Point Endpoint Security VPN Service only on company-owned devices

Di_Junior — Fri, 15 May 2020 14:35:15 GMT

Hi Pierre

Did you perhaps found a solution for this?

Thanks in advance