topic Re: Check Point Capsule in SASE and Remote Access

Check Point Capsule

Torbjorn_Granhe — Tue, 14 Aug 2018 14:02:14 GMT

I´m working with a large multinational company. They are using Check Point Mobile with Windows 7.

Now they are starting to deploy windows 10 and are looking at Always on VPN.

I have come across three options:

1. Always on VPN with the native Win VPN client and Check Point Capsule plugin against Checkpoint backen

-Pros - Small software installation from store, uses existing backend

-Cons - Poorly documented, looks like the client has no updated since 2014?

2. Always-connect with the Check Point Mobile client against Checkpoint backend

-Pros - Uses existing backend

-Cons - Check Point Mobile Software broke between 1709 and 1803

3. Always on VPN with the native Win VPN client against Windows RRAS in backend

-Pros - No software installation, Device tunnel

-Cons - Needs a complete new backend with Windows RRAS

Has anyone successfully used option 1 with Capsule and Always on VPN configuration?

Is option 1 a stable simple solution or is option 2 better?

Does option 1 have any limitations compared to option 2?

All input is appreciated

Mr Tbone

Re: Check Point Capsule

PhoneBoy — Fri, 17 Aug 2018 01:57:10 GMT

If I remember right, the native VPN client in Windows is L2TP.

This has been supported for quite some time across numerous Windows versions.

Unfortunately, I have never tried it as an "always on VPN".

As far as I know, we "fixed" the issue with Check Point Mobile and Windows 10 build 1809 in May.

See: Check Point Endpoint Security Client Support Schedule for New Operating Systems

If you're still having issues still, please open a ticket with the TAC.

Re: Check Point Capsule

Torbjorn_Granhe — Fri, 17 Aug 2018 13:11:54 GMT

Hi,

Windows native has support for pptp, l2tp, sstp and ikev2 (ipsec). So it´s quite competent. 🙂

But it cannot, by it self, connect to a Check Point server. It needs the Check point Capsule Plugin.

With this plugin Windows/Capsule can connect to an existing Check Point server.

But I cannot find many reports on how it works, and if its a stable solution.

Of course Check Point has fixed and will fix every upcoming incompatibility problems with Windows 10. But at every windows 10 release we have to wait for a check point release. Then we can package, test and deploy.

A lot of time can be saved by using a built in product.

/Tbone