topic Re: Checkpoint Remote Access SSL VPN and Capsule timeout in SASE and Remote Access

Checkpoint Remote Access SSL VPN and Capsule timeout

ihenock101 — Fri, 20 Jan 2023 07:07:17 GMT

Hi All,

I'm writing in regards to configuring the remote SSL VPN on my Checkpoint gateway server. I have configured the server, and by default, the idle timeout when a client connects is set to 2 hours.

I would like to make two changes to this configuration:

1. Set the idle timeout value when a user connects

2. Set the time limit for when a user can connect

Please let me know if these changes are possible and what steps I need to take in order to implement them. I’ve attached the SSL extender screenshot. You can see that it starts with two hours and keeps counting down.

Regards,

Re: Checkpoint Remote Access SSL VPN and Capsule timeout

G_W_Albrecht — Fri, 20 Jan 2023 07:32:09 GMT

We have to keep legacy SNX and MAB apart:

SNX sk77380 says: No, there is no idle session timeout for SNX.
That functionality does not currently exist in SNX. If you connect SNX, the only timeout is the re-authentication available under Global Properties-Remote Access-SSL Network Extender-More Advanced Settings

MAB sk176924: How to increase SNX session timeout

Re: Checkpoint Remote Access SSL VPN and Capsule timeout

ihenock101 — Fri, 20 Jan 2023 08:02:20 GMT

@G_W_Albrecht the re-authentication timeout value for the SNX in the global properties is 480 minutes however as you can see from the attachment the SNX shows 2 hour expiration time

Re: Checkpoint Remote Access SSL VPN and Capsule timeout

G_W_Albrecht — Fri, 20 Jan 2023 08:47:20 GMT

You are using MAB Network Mode and need to configure it in Dashboard:

Re: Checkpoint Remote Access SSL VPN and Capsule timeout

ihenock101 — Fri, 20 Jan 2023 11:20:46 GMT

@G_W_Albrecht Thanks a lot Sir. does it require a restart since it is in production evironment?

Re: Checkpoint Remote Access SSL VPN and Capsule timeout

G_W_Albrecht — Fri, 20 Jan 2023 14:21:50 GMT

Publish and Policy Install should be enough for all new connections.