topic Re: ATM VPN in SASE and Remote Access

ATM VPN

HIJ — Fri, 08 Nov 2024 15:48:27 GMT

Hello,

I’m trying to configure a VPN between an ATM and a Security Gateway (SG). The VPN agent has already been installed on the ATM.

I’ve updated the `trac.config` file as required, but I am unable to find the Check Point icon to start or check the VPN status. Additionally, I can’t locate the file `C:\Program Files (x86)\CheckPoint\Endpoint Security\UIFramework\Bin\WUI\cptrayWUI.exe`.

Could you suggest troubleshooting steps or any other actions I should try to resolve this issue?

Regards,

Re: ATM VPN

PhoneBoy — Fri, 08 Nov 2024 19:23:06 GMT

The ATM version of the client is controlled entirely via CLI: https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/Remote-Access-Clients-CMD.htm

Re: ATM VPN

HIJ — Sat, 09 Nov 2024 09:46:59 GMT

Thank you for your response. Would you be able to share an example of a configuration script or outline the steps to follow? This is my first time setting this up, and while I have reviewed the documentation, I suspect I may have missed something.

Re: ATM VPN

PhoneBoy — Mon, 11 Nov 2024 14:40:08 GMT

The exact steps will depend on the authentication requirements, but it should work more or less the same as doing it in a GUI.
Note that the CLI does not support SAML-based authentication, which requires a web browser (which is not appropriate for "headless" ATM usage).

But, in general, you will create a site first: https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/create.htm?tocpath=Remote%20Access%20Clients%20Command%20Line%7CCLI%20Commands%7C_____4

If you're doing certificate-based authentication, you'll need to enroll a certificate with one of:

Then connect: https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/connect.htm?tocpath=Remote%20Access%20Clients%20Command%20Line%7CCLI%20Commands%7C_____2

Re: ATM VPN

HIJ — Thu, 21 Nov 2024 09:13:34 GMT

I have a VPN established between an ATM and a Check Point firewall. The ATM operates with two user sessions: Administrator and Normal User. While the VPN functions correctly in the Administrator session, it requires manual reconnection every time when accessed by the Normal User. How can I resolve this issue to ensure the VPN remains active for the Normal User without requiring repeated manual reconnections?

Re: ATM VPN

PhoneBoy — Thu, 21 Nov 2024 13:17:55 GMT

Are you switching users on the same system?
The Remote Access connection is tied to the user, generally speaking.
Which means if you log out as one user and log in as a different one, the VPN connection will drop.
If you want the VPN to remain active regardless of user, use a Machine Certificate for authentication: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/Machine-Certificate.htm

Re: ATM VPN

HIJ — Thu, 21 Nov 2024 13:36:56 GMT

The configuration was set up in the Administrator account, and the VPN works perfectly. However, after rebooting the machine, the default user account cannot connect to the VPN automatically. If we reconnect manually, it works. How can this issue be resolved?