topic Re: Harmony endpoint - VPN blade - pushing VPN parameter to the client in SASE and Remote Access

Harmony endpoint - VPN blade - pushing VPN parameter to the client

freeman91 — Tue, 23 Sep 2025 19:30:29 GMT

Hi,

I have around 150 deployed harmony endpoint client.

Those clients have four installed blades on them.

Those blades are Anti-Malware, Anti-Bot, Forensics, and Threat Extraction and Emulation.

For 15 clients, I need to install an additional blade called VPN.

For those 15 clients, I need to push the VPN parameters via Push operation.

In my research about push operations, I found that when I click on push operations, then click on add, and choose what I want to push, meaning agent settings, I select the VPN site, and then choose the device on which I will perform the installation, and I pick all the necessary VPN parameters, such as the gateway name, the IP address, the fingerprint, and everything else, those settings are not pushed to the client side.

They are actually pushed, but within the installed VPN blade on the client side, those parameters are not visible. In other words, on the client side, the client has to manually enter the IP address, which is something I don’t want.

I want the IP address to already be entered just as I set it through the push operation.

am I doing somthing wrong?

Re: Harmony endpoint - VPN blade - pushing VPN parameter to the client

PhoneBoy — Wed, 24 Sep 2025 21:37:09 GMT

What version of client and is this managed on-prem (if so, by what version/JHF) or is this Infinity Portal?
Have you also reviewed: https://support.checkpoint.com/results/sk/sk179798

Re: Harmony endpoint - VPN blade - pushing VPN parameter to the client

freeman91 — Thu, 25 Sep 2025 12:21:27 GMT

It is on Infinity Portal.

88.72.2001

Status of Push command is succesful, but on client side, clinet vpn does not get parameters that I fill in via Push command.

He needs to enter the manualy, and I do not like it.
Is this normal behavior or?

Re: Harmony endpoint - VPN blade - pushing VPN parameter to the client

PhoneBoy — Thu, 25 Sep 2025 18:35:13 GMT

What does C:\ProgramData\CheckPoint\Logs\DAF\idafserver.log have to say on a client where you pushed?
Most likely TAC will be needed to assist with this.

Re: Harmony endpoint - VPN blade - pushing VPN parameter to the client

the_rock — Thu, 25 Sep 2025 18:41:40 GMT

Not an endpoint expert by any means, but to me, that does not sound right/normal. Is it same for ANY endpoint machine?

Andy

Re: Harmony endpoint - VPN blade - pushing VPN parameter to the client

freeman91 — Thu, 25 Sep 2025 19:03:58 GMT

for now, 4/4

non of them had VPN blade before

non of them received vpn parameters after push command.

but only after push operation, thay are able to manualy add or remove vpn sites.
Even if I enable VPN, they was unable to enter them manualy until I push paratmeter to them.

Re: Harmony endpoint - VPN blade - pushing VPN parameter to the client

the_rock — Thu, 25 Sep 2025 19:09:34 GMT

I dont know my friend, maybe TAC can check it?

Izvini, nemam vise ideja lol

Andy

Re: Harmony endpoint - VPN blade - pushing VPN parameter to the client

freeman91 — Thu, 25 Sep 2025 19:16:25 GMT

It is like 90k line of logs. Can you be more specific what to search for?

Re: Harmony endpoint - VPN blade - pushing VPN parameter to the client

PhoneBoy — Thu, 25 Sep 2025 19:28:28 GMT

I don't know what exactly is in this file, but this is where the SK I pointed to previously said to look if a Push operation didn't work.
Best bet is to engage TAC.