topic Re: Block macOS access to the VPN client in SASE and Remote Access

Block macOS access to the VPN client

Beowulff_ — Thu, 27 Feb 2025 18:35:28 GMT

Hi,
Is it possible to block any macOS machine from logging into the VPN client?
I have already verified sk182226, but it only works if you enable the compliance function when installing the client.
But in this case I need to block any macOS, even without the compliance function installed.

Re: Block macOS access to the VPN client

PhoneBoy — Fri, 28 Feb 2025 16:35:20 GMT

You need to enable SCV and configure some Windows-specific checks.
See: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/Secure-Configuration-Verification.htm?tocpath=Secure%20Configuration%20Verification%7C_____0#Secure_Configuration_Verification

By default, SCV support is disabled for macOS, so SCV check should fail.
You can enable it and configure a specific policy with: https://support.checkpoint.com/results/sk/sk182226

Re: Block macOS access to the VPN client

the_rock — Fri, 28 Feb 2025 17:56:40 GMT

I never knew about below options in access roles (IA blade needed to use), but maybe something that could work.

Andy

Re: Block macOS access to the VPN client

Beowulff_ — Wed, 05 Mar 2025 14:00:13 GMT

Hello, thanks for the reply.
It's working fine on Windows.
I enabled the options for MacOS, but if I don't enable the compliance option on the MAC endpoint, it won't allow clients that don't verify SVC to log in.
These are unmanaged MACs and I can't guarantee that they will enable the compliance option, so I wanted to block VPN access from any MAC. Would that be possible?
Attached is the SVC file I'm testing.

Tks

Re: Block macOS access to the VPN client

Beowulff_ — Wed, 05 Mar 2025 14:15:12 GMT

Hello, thanks for the reply.
But I need to completely block MAC users from accessing the site, not even letting them log into the VPN.

Tks

Re: Block macOS access to the VPN client

PhoneBoy — Fri, 07 Mar 2025 00:22:36 GMT

It shouldn't matter if you enable Compliance on the Mac endpoint or not.
You've included Mac-specific checks in your local.scv file (the SCVPolicyMac abd SCVNamesMac sections).
These should be removed if you do not want Macs to connect.

Re: Block macOS access to the VPN client

Beowulff_ — Fri, 07 Mar 2025 15:27:58 GMT

Even after removing sessions (the SCVPolicyMac abd SCVNamesMac), the MAC remains connected normally to the VPN.

New svc file

Re: Block macOS access to the VPN client

PhoneBoy — Fri, 07 Mar 2025 16:14:42 GMT

Please check that SCV is actually enabled in Global Properties and the option to ignore when the client doesn't support it is NOT checked as shown below.
Otherwise, I suggest engaging with TAC.

Re: Block macOS access to the VPN client

the_rock — Fri, 07 Mar 2025 17:15:26 GMT

K, understood. I dont know for sure how SCV would work in such instance (never really tested it), but maybe worth check with TAC. let me do some tests in the lab and see how far I get.

Best,

Andy

Re: Block macOS access to the VPN client

the_rock — Fri, 07 Mar 2025 17:23:11 GMT

This is what AI Copilot provided, though to me, seems very similar to the sk you mentioned.

Andy

****************************

To block macOS access to the VPN client, you can stop the Check Point VPN service and GUI process. Here are the steps to do this:

Open the Terminal on the macOS endpoint computer.

Stop the GUI process:

sudo launchctl bootout gui/$(id -u) /Library/LaunchAgents/com.checkpoint.eps.gui.plist

Stop the Check Point VPN service:

sudo launchctl bootout system /Library/LaunchDaemons/com.checkpoint.epc.service.plist

These commands will stop the Check Point VPN client from running on the macOS endpoint computer. If you need to start the services again, you can use the following commands:

Start the GUI process:

sudo launchctl bootstrap gui/$(id -u) /Library/LaunchAgents/com.checkpoint.eps.gui.plist

Start the Check Point VPN service:

sudo launchctl bootstrap system /Library/LaunchDaemons/com.checkpoint.epc.service.plist

This will re-enable the Check Point VPN client on the macOS endpoint computer.

Re: Block macOS access to the VPN client

D_Riddleberger — Fri, 24 Oct 2025 17:08:18 GMT

Beowulff_ and Andy,

Have you been able to make any progress on blocking MacOS users? I have a similar scenario and sk182226 also did not resolve.

Thanks

Dan

Re: Block macOS access to the VPN client

the_rock — Fri, 24 Oct 2025 17:19:28 GMT

Hey Dan,

I might try it this Sunday in R82 lab.

Re: Block macOS access to the VPN client

the_rock — Fri, 24 Oct 2025 17:27:49 GMT

Btw, did you ever end up opening TAC case about it?

Re: Block macOS access to the VPN client

D_Riddleberger — Fri, 24 Oct 2025 17:35:15 GMT

No sir, I just started looking into this as a new issue for me. I think it was Phone Boy who suggested that the original post owner Beowulff_engage TAC.

Re: Block macOS access to the VPN client

the_rock — Fri, 24 Oct 2025 17:45:38 GMT

Dont worry, I got you. Sorry, just came back from Africa and Canary Islands, no lab access there lol

Once Im back from my folks in Totonto to my home in Ottawa on Sunday, will definitely give this a go.

Re: Block macOS access to the VPN client

the_rock — Sat, 25 Oct 2025 14:52:17 GMT

Hey Dan,

What version are you on? Please let me know, so I can try it on the right one. I have either R81.20 or R82

Re: Block macOS access to the VPN client

the_rock — Sun, 26 Oct 2025 22:20:57 GMT

Hey Dan,

Sorry, was going to try this today, but tired after long drive, so will give it a go tomorrow.

Re: Block macOS access to the VPN client

the_rock — Mon, 27 Oct 2025 17:18:38 GMT

Hey Dan,

Just to update you, tried this on R81.20 and R82, no joy, sorry mate : - (. I wont give up though.

Re: Block macOS access to the VPN client

D_Riddleberger — Mon, 27 Oct 2025 17:22:58 GMT

Thanks Andy.

Per your message on Saturday this is R81.20 for Mgmt and Gateways. Did we ever hear from Beowulff_to see if a TAC case was opened?.

Re: Block macOS access to the VPN client

the_rock — Mon, 27 Oct 2025 17:44:54 GMT

Had not seen any confirmation on that, sorry.