topic Re: SCV Enforcement Per Gateway (Not Global) in SASE and Remote Access

SCV Enforcement Per Gateway (Not Global)

Alexander_Urits — Thu, 03 May 2018 20:40:48 GMT

Is there any chance for SCV enforcement per gateway and not global?

It's very problematic to have same rules for different gateways.

For example, I've a customer who has multiple security gateways managed by the same management server.

Now he wants to validate the PCs domain membership for one of the gateways but don't want this requirement to exist on another. I cannot find anyway to workaround this with support.

Re: SCV Enforcement Per Gateway (Not Global)

PhoneBoy — Thu, 03 May 2018 21:44:50 GMT

In R80.20? Not that I'm aware of.

Re: SCV Enforcement Per Gateway (Not Global)

Alexander_Urits — Thu, 03 May 2018 21:47:43 GMT

Even in R80.70, or any other possible workaround would be appreciated.

Re: SCV Enforcement Per Gateway (Not Global)

PhoneBoy — Thu, 03 May 2018 22:51:47 GMT

I've branched this into a new thread in the Remote Access‌ section.

The workarounds I see are:

Use a client that explicitly doesn't require SCV to connect to the relevant gateway and enable that option (see below)
Exclude the hosts/services that are accessible from that gateway (see below)
Put the gateways in different management domains

Can you describe the use case you're trying to support with this request?

Re: SCV Enforcement Per Gateway (Not Global)

Alexander_Urits — Thu, 03 May 2018 22:59:21 GMT

>> Can you describe the use case you're trying to support with this request?

The use case is pretty simple as described before:

I've a customer who has multiple security gateways managed by the same management server.

Now he needs to validate the PCs domain membership for one of the gateways (some kind of regulation demand), but don't want this requirement to exist on another. (On other gateway even local VPN authentication would be satisfactory.)

The SCV exceptions are not good enough for this, since they are only host and service based - even cannot add networks (adding hundreds of hosts doesn't seem to be a good option).

Re: SCV Enforcement Per Gateway (Not Global)

PhoneBoy — Thu, 03 May 2018 23:07:44 GMT

If the hosts accessed from each gateway are different, then implement the exclusion workaround above.

It will do the SCV check on the other gateway but still permit access.

Otherwise, you'll have to manage the other gateway with a separate management domain to have different SCV settings at the moment.

Re: SCV Enforcement Per Gateway (Not Global)

Alexander_Urits — Thu, 03 May 2018 23:12:10 GMT

The host are different, but I need to allow whole networks (the other gateway has also S2S VPN to additional gateways and the VPN clients should be able to access those networks too, via this site).

Re: SCV Enforcement Per Gateway (Not Global)

G_W_Albrecht — Fri, 04 May 2018 08:59:50 GMT

SVC can be configured in the SMS local.scv file (see sk41336 and sk38702 for details) that is transmitted to the GW during policy install. As a workaround, it would be possible to edit the file, install policy on the special GW and then undo the edits.

Re: SCV Enforcement Per Gateway (Not Global)

XavierBens — Fri, 04 May 2018 14:29:34 GMT

I've thought of doing the same action described by https://community.checkpoint.com/people/g.alba066e051-da82-3e7a-84e6-2bcbff226984

Re: SCV Enforcement Per Gateway (Not Global)

Alexander_Urits — Fri, 04 May 2018 19:35:01 GMT

I don't think that this workaround is really usable.
Since it would require doing it again and again (with every change in policy, it would require full attention for this issue).

I'm wondering if there is someone out there who is really uses this SCV feature in a real work scenario.

Or if there is any other way to accomplish the task (of letting only domain joined computer to be able to connect via VPN)

Re: SCV Enforcement Per Gateway (Not Global)

PhoneBoy — Fri, 04 May 2018 19:39:15 GMT

The part that seems to be unique to your customer is having different gateways managed by the same domain with different SCV policies.

Most organizations that implement SCV do so for all their gateways, not just for specific ones.

Re: SCV Enforcement Per Gateway (Not Global)

Alexander_Urits — Fri, 04 May 2018 20:16:21 GMT

Ok, let's say that what you say that's the mainstream.

What about different policies for different users? Is that also something extraordinary?

Re: SCV Enforcement Per Gateway (Not Global)

PhoneBoy — Fri, 04 May 2018 20:31:18 GMT

There are usually minimum standards to apply to all users who connect, regardless of who they are.

There might be some different standards based on who the user is and what they access.

Mobile Access Blade with Endpoint Security on Demand offers the kind of granularity you're looking for, but that's a different mechanism from SCV.

Re: SCV Enforcement Per Gateway (Not Global)

Alexander_Urits — Sat, 05 May 2018 07:44:33 GMT

Well I'm aware of the Mobile Access Blade and the Endpoint Security on Demand.

But my feeling is that the MOB is a product that is not being developed for years. It's even abandoned (not yet included) from the R80.10 GUI.

Re: SCV Enforcement Per Gateway (Not Global)

PhoneBoy — Sat, 05 May 2018 21:56:57 GMT

While there are some features/functions of Mobile Access that require the old SmartDashboard in R80.x, we actually support unified policies that include Mobile Access in R80.10.

In terms of major features, we've developed Reverse Proxy functionality and there has been some work done to replace the need for Java for SNX (because browsers stopped supporting it).

So to say that Mobile Access Blade hasn't had development in years is not true.

Re: SCV Enforcement Per Gateway (Not Global)

Lithin_Mathew — Tue, 20 Oct 2020 03:29:20 GMT

Hi @PhoneBoy,

Hope you are doing good.

Need assistance on SCV for R80.30 SMS and Gateway, as we are planning to implement Domain Membership Validation using SCV checks.

We have Checkpoint Gateways in Multiple Regions with Remote Access VPN on each gateway (all managed by the same SMS), the domain for machines in each region are different from each other.

So wanted to confirm if we have an option to deploy Domain Validation specific to each gateway.

Re: SCV Enforcement Per Gateway (Not Global)

PhoneBoy — Tue, 20 Oct 2020 04:08:21 GMT

That is described by this comment: https://community.checkpoint.com/t5/Remote-Access-VPN/SCV-Enforcement-Per-Gateway-Not-Global/m-p/21461/highlight/true#M760

Or you could include a check for all relevant domains on all gateways?

Re: SCV Enforcement Per Gateway (Not Global)

Lithin_Mathew — Thu, 22 Oct 2020 16:42:05 GMT

Thank you @PhoneBoy for your quick response as usual.

I tried to add all the domains to the Registry Monitor, but it does not work, could you confirm if the below script I am using is correct:

: (RegMonitor
:type (plugin)
:parameters (
:string ("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\MachineDomain=abc.domain")

:string ("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\MachineDomain=def.domain")
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Your computer doesn't meet the domain membership requirements.")
:end (admin)
)

Re: SCV Enforcement Per Gateway (Not Global)

PhoneBoy — Thu, 22 Oct 2020 23:02:39 GMT

This condition can't possibly work because both conditions can't possibly be true at the same time.
Also, you don't need to include HKEY_LOCAL_MACHINE\ as that's assumed.
Probably something like:

: (RegMonitor :type (plugin) :parameters ( :begin_or(or1) :string ("SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\MachineDomain=abc.domain") :string ("SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\MachineDomain=def.domain") :end(or1) :begin_admin(admin) :send_log(alert) :mismatchmessage("Your computer doesn't meet the domain membership requirements.") :end(admin) )

Refer to the E80.60 / E80.61 / E80.62 / E80.64 Remote Access Clients for Windows OS Administration Guide for additional syntax on SCV.

Re: SCV Enforcement Per Gateway (Not Global)

Lithin_Mathew — Mon, 23 Nov 2020 14:35:26 GMT

Hi @PhoneBoy,

I tried using the above lines in the local.scv file but the the policy install failed, error message "Failed to merge SCV policies. Local SCV file may be corrupt".

Attached the screenshot for your reference.