topic Flowchart for choosing the right Remote Access VPN option in SASE and Remote Access

Flowchart for choosing the right Remote Access VPN option

crescentwire — Thu, 05 Jun 2025 13:45:50 GMT

Update (June 2025):

I've made the original, editable version of this flowchart publicly available on GitHub for anyone who wants to contribute, fork it, or help improve it going forward.

You can find it here: https://github.com/crescentwire/cp-ra-vpn-flowchart

I do not plan to maintain this document personally, but I hope this makes it easier for the community to build on the original work and keep it current over time. Contributions are welcome!

---

Hey everyone, as a long-time customer and now-employee of Check Point, it's not always been easy to navigate our remote access VPN solutions. There are a lot of them, and while they have specific use cases and relevance, it can sometimes feel overwhelming to sift through them and choose the right one.

I've put together a flow chart that details all options (as of April 2025) in hopes this makes your life easier. Even though I'm on the vendor side now, the customer side of the table is only arms' length--and I want to help and empower wherever I can.

Thanks so much for your time and I hope this is helpful to you.

(Image below is a preview; the attached PDF has active hyperlinks--please download and use this instead of the image.)

Re: Flowchart for choosing the right Remote Access VPN option

the_rock — Fri, 11 Apr 2025 13:30:34 GMT

EXCELLENT!

Re: Flowchart for choosing the right Remote Access VPN option

Danny — Sun, 13 Apr 2025 10:33:31 GMT

Thank you! Please:

keep this overview up-to-date
put it into an official Check Point SK article
add a column that details if IPv6 is supported
add a column about the supported crypto suites
add a column to describe how to monitor those specific users in the GUI and on CLI
add version information to your PDF document
add more info about the SASE client
add info regarding capsule workspace as it's not supported anymore
add info regarding RAS-VPN login options to SMB appliances
share the draw.io chart with us so we can extend the document as a community

Re: Flowchart for choosing the right Remote Access VPN option

the_rock — Sun, 13 Apr 2025 13:06:28 GMT

Great ideas @Danny

Re: Flowchart for choosing the right Remote Access VPN option

Oliver_Fink — Tue, 15 Apr 2025 06:04:10 GMT

Great work. I would like to mention that Capsule Workspace is discontinued – EoS 12/2024.

Re: Flowchart for choosing the right Remote Access VPN option

crescentwire — Tue, 15 Apr 2025 14:09:32 GMT

Thanks, @Oliver_Fink . The Capsule Workspace row does actually indicate it's end of support as of December 2024. Maybe I need to make that more bold/clearer.

Appreciate your support and feedback.

Re: Flowchart for choosing the right Remote Access VPN option

Danny — Tue, 15 Apr 2025 16:05:18 GMT

@crescentwire : It's already clearly marked as discontinued but your title says "choosing the right Remote Access VPN option" and then your flowchart mentions a discontinued product which cannot be the right solution by its status. As you're a Check Point employee, we would appreciate official guidance for users who need mobile device support, which was previously provided by Mobile Workspace. If there isn't a successor or supported alternative, it might be better not to include it as a RAS VPN option.

Re: Flowchart for choosing the right Remote Access VPN option

crescentwire — Tue, 15 Apr 2025 16:07:58 GMT

Thanks, Danny. I appreciate your perspective.

I was trying to document all possible solutions, which historically has included Capsule Workspace. Because I used our SKs as a guide for building this flowchart--and because CW is still mentioned in these SKs (see sk67820 - Check Point Remote Access Solutions - Gateway-Based Access and sk84560 - Check Point VPN License Guide)--I wanted to draw attention to it here.

But, you are right that it shouldn't be available as an option since it's been discontinued. I've removed it from the diagram and will reupload the fixed version shortly.

Thanks again.

Re: Flowchart for choosing the right Remote Access VPN option

Ted_Serreyn — Mon, 28 Apr 2025 16:00:10 GMT

well if we are going with all possible solutions, the linux support should mention the snx client for linux.

In addition, it may be a good place to mention the snx-rs client. I've been using this to do some automated testing.

Re: Flowchart for choosing the right Remote Access VPN option

the_rock — Mon, 28 Apr 2025 16:09:10 GMT

Im pretty sure it will be fully updated.

Andy

Re: Flowchart for choosing the right Remote Access VPN option

Steven_Sultana — Wed, 30 Apr 2025 09:20:43 GMT

It maybe useful to elaboration on the first decision - do you want traditional VPN or SASE?

Eg. if you want compliance on mobile devices, SASE is the way to go. If you have multiple sites and/or multi-cloud, SASE is possibly "better/preferred/more streamlined/less complex" than traditional MEP/Secondary Connect technology. Etc.

Re: Flowchart for choosing the right Remote Access VPN option

the_rock — Wed, 30 Apr 2025 12:00:13 GMT

Super valid point Steven.

Re: Flowchart for choosing the right Remote Access VPN option

crescentwire — Thu, 05 Jun 2025 13:48:19 GMT

Hi @Danny , thanks for all these suggestions. You are welcome to add as much as you like within the public GitHub repository I've made available for community contributions. Please see my update in the original post's body above.

Re: Flowchart for choosing the right Remote Access VPN option

G_W_Albrecht — Thu, 05 Jun 2025 14:34:57 GMT

The listed sk171419 is not found...