topic Re: Mobile access portal with Office 365 in SASE and Remote Access

Mobile access portal with Office 365

Ted_Serreyn — Thu, 05 Sep 2019 16:49:00 GMT

Does anyone have r80.20 or later working with office 365?

In particular I am interested in the following:

Capsule Mobile access to office365 on IOS.

Mobile access link to OWA in SSL portal.

native mail access in SSL portal.

Currently I have apps configured, but they are not working and no error logs are currently being generated.

Re: Mobile access portal with Office 365

PhoneBoy — Fri, 06 Sep 2019 22:06:57 GMT

There's an SK for Capsule Workspace on O365: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103721

Re: Mobile access portal with Office 365

Ted_Serreyn — Mon, 09 Sep 2019 17:18:07 GMT

agree, however my primary goal was a direct web link for unsecured PC users, rather than the checkpoint capsule configuration which this SK is designed to answer.

The last document I have seen on it said O386 was supported as OWA as of R77.30, but haven't seen anything more recent and my attempts have met in failure.

I have asked to see if anyone knows of any clients that have it working with O365, but so far no one is coming forward.

I now have a ticket opened for it, as it has become a more critical discussion.

Re: Mobile access portal with Office 365

PhoneBoy — Mon, 09 Sep 2019 17:21:55 GMT

You did say "Capsule Mobile access to office365 on IOS" which of course made me think of Capsule Workspace.
But I guess what you're referring to is VPN access from an iOS device, a very different question 😬

Re: Mobile access portal with Office 365

Ted_Serreyn — Tue, 10 Sep 2019 12:14:14 GMT

So after opening a ticket with support, I have now been told that OWA access to office 365 is not supported.

I and my customer are both shocked and surprised by this given the amount of time that has passed since the release of office 365.

Re: Mobile access portal with Office 365

G_W_Albrecht — Tue, 10 Sep 2019 12:50:14 GMT

According to sk94489 Mobile Access Portal Support for Outlook Web App (OWA) 2013/2016, Hostname Translation (HT) method is supported for OWA. Also see Mobile Access Administration Guide R80.30 p.211ff for Troubleshooting OWA.

Please explain in detail why TAC told you that OWA access to office 365 is not supported.

Re: Mobile access portal with Office 365

Ted_Serreyn — Tue, 10 Sep 2019 13:01:36 GMT

Good question. I would like to know why myself.

Re: Mobile access portal with Office 365

Ted_Serreyn — Tue, 10 Sep 2019 13:35:40 GMT

Saying it only applies to exchange servers, not cloud services.

Re: Mobile access portal with Office 365

PhoneBoy — Tue, 10 Sep 2019 16:40:39 GMT

I'm curious what you're doing to prevent people from logging into their Office 365 account from some other location (e.g. directly).
Because if you're not doing that, I don't see the point of using MAB.
I'll see if I can get R&D to weigh in here.

Re: Mobile access portal with Office 365

Holger_Lange — Thu, 10 Oct 2019 11:14:00 GMT

This sounds very much like a problem one of our customer has.
In our case, the reason why they can't access Office365 directly (as Phoneboy suggested) is that the authentication is handled by internal systems. That's why the mobile access connection is needed.
The setup worked fine with R77.30 but we have not found a solution for R80.x yet.
SR with Check Point support is open 9 Months now and the issue seems to be reproducible in a Lab environment but R&D is currently still working on the solution.

Re: Mobile access portal with Office 365

Ted_Serreyn — Wed, 30 Oct 2019 20:10:16 GMT

We were trying for the same kind of approach here. Two factor being enabled for all office 365 sites outside of the whitelisted ones. If you login to portal, you would be whitelisted.

Too bad checkpoint can't come up with a solution on this, I would think it would be pretty common.

Re: Mobile access portal with Office 365

Holger_Lange — Mon, 04 Nov 2019 07:56:59 GMT

Our SR on this issue is still unresolved but I think we are getting closer.
recent tests indicated that the key point here might be that certain URLs that need exclusions from hostname translation.
You can manage these using guidbedit at 'connectra_global_properties' section 'hostnames_not_to_translate'
The list of URLs in 'hostnames_not_to_translate' has some changes from R77.30 to R80.x but he have not yet figured out which of these are relevant for Office 365, but it may be a good Idea to check on these.

Re: Mobile access portal with Office 365

Ted_Serreyn — Thu, 07 Nov 2019 19:02:24 GMT

thanks, please keep me informed.

Re: Mobile access portal with Office 365

Holger_Lange — Fri, 28 Feb 2020 09:57:51 GMT

@Ted_Serreyn

We got a solution!
apparently some changes in the libLinkTrans.so and libModCvpn.so were necessary.
We finally got a readily packaged Hotfix (for R80.30 JHF Take 19)
cvpn_HOTFIX_R80_30_JHF19_MAB_URLPARSER_MAIN_GA_FULL.tgz

The fix will also be included in future Jumbo HFA Takes

Watch out for Issue ID MAGB-781

Re: Mobile access portal with Office 365

Ted_Serreyn — Mon, 02 Mar 2020 16:30:25 GMT

thanks for keeping on top of it, I'm excited to see in the the jumbo hotfix so we can reconfigure things and try this with the customer again.

Especially important as people are working home with the corona virus.

Re: Mobile access portal with Office 365

itsysadmin — Thu, 14 Mar 2024 12:00:37 GMT

Hi,

R81.20 here and still no luck having 0365 OWA to work on the Portal. In our case the access is stuck loading the modern authentication page (login.microsoft.com) for the user to input the login information. We get just a blank page on this stage and we cannot move forward.