topic Re: VPN Setup for Clientless Mobile Devices (R82) in SASE and Remote Access

VPN Setup for Clientless Mobile Devices (R82)

itmoelln — Mon, 09 Feb 2026 16:17:00 GMT

All the different VPN options and its namings are quite confusing with Checkpoint and make research harder. We want to enable iOS and Android devices to use native "Always On" VPN with our Checkpoint Gateway. From what I found IKEv2 is required by iOS to be able to setup "Always On VPN" and manage it by an MDM. From what I read IPSec and IKEv2 was improved with R82.

What do I have to configure to enable the mobile clients to connect clientless to our Gateway? (We're also using Endpoint Security VPN for the Windows Clients in parallel, as Clientless VPN under Windows doesn't seem to be an option yet.) The information from the manual wasn't really helpful yet. A guide for where and what to configure would be helpful. Found the general VPN settings under global properties -> VPN and Remote Access and cluster properties -> IPSec VPN and VPN Clients but don't really know what are the relevant aspects for that usecase.

Re: VPN Setup for Clientless Mobile Devices (R82)

PhoneBoy — Mon, 09 Feb 2026 23:58:38 GMT

The only truly "clientless" option supported is L2TP over IPsec, which also works on Windows.
According to this thread, you need "Allow older clients to connect to this gateway" checked: https://community.checkpoint.com/t5/General-Topics/Allow-older-clients-to-connect-to-this-gateway-disabling-L2TP/m-p/261384#M44211

Re: VPN Setup for Clientless Mobile Devices (R82)

the_rock — Tue, 10 Feb 2026 00:19:30 GMT

Yes, what Phoneboy mentioned is what you need to do. I actually had TAC case about this few months ago and they advised me the same.