topic Re: Change of authorization(CoA) in remote VPN in SASE and Remote Access

Change of authorization(CoA) in remote VPN

Virupaksha_PT — Thu, 19 Sep 2019 05:35:28 GMT

Hi Folks,

Can we do Change of authorization (CoA) in remote access VPN as we want to perform a test case where in the end users connects through Checkpoint VPN but the compliance of the system is checked via Checkpoint Endpoint security egent installed in a Laptop.

Please suggest.

Checkpoint current version is r77.30

Regards,

Viru

Re: Change of authorization(CoA) in remote VPN

G_W_Albrecht — Thu, 19 Sep 2019 07:29:50 GMT

A test case with a version that is supported just for the next 11 days ? Sure ?

Re: Change of authorization(CoA) in remote VPN

Virupaksha_PT — Thu, 19 Sep 2019 07:56:16 GMT

Actually the requirement is that suppose if virus is get installed in user PC with running Checkpoint remote access VPN. So now if that user is going to access some other server, so that server get also affected from that user.

So can we implement this change of authorization policy in checkpoint remote access VPN configuration?

Re: Change of authorization(CoA) in remote VPN

G_W_Albrecht — Thu, 19 Sep 2019 11:16:23 GMT

Firstly - I would do this in R80.20 or R80.30 ! And i would use EPS client instead of VPN client only...

Re: Change of authorization(CoA) in remote VPN

FedericoMeiners — Thu, 19 Sep 2019 12:50:56 GMT

@Virupaksha_PT I don't think that you can achieve this with the default remote access client, the closest solution for this is to use ESOD (Endpoint security scanner on demand) to check various configuration of the host connecting to the VPN (Antivirus, Antivirus signatures, update status of the OS, among others). Note that you can only use this feature with SSL VPN.

As stated by @G_W_Albrecht you will need the complete suite of endpoint security if you want to achieve such intelligence.

Regards,

Federico Meiners

Re: Change of authorization(CoA) in remote VPN

PhoneBoy — Fri, 20 Sep 2019 20:08:06 GMT

This is the kind of thing that can be done using the Endpoint Compliance Blade (as opposed to ESOD).