topic Re: SSL Network Extender - client upgrade upon connection in global properties in SASE and Remote Access

SSL Network Extender - client upgrade upon connection in global properties

Daniel_Kavan — Wed, 18 Jan 2023 21:48:53 GMT

So, I want clients to upgrade upon connection from one gateway, yet not others... Alas, this is a global property...

Is there a way to leave this remote access global property as Do not upgrade, yet initiate the upgrade on one specific gateway?

Re: SSL Network Extender - client upgrade upon connection in global properties

the_rock — Wed, 18 Jan 2023 22:19:16 GMT

Not that I know of, but will look into it. Let me see if R81.20 has different options.

Re: SSL Network Extender - client upgrade upon connection in global properties

PhoneBoy — Wed, 18 Jan 2023 23:27:23 GMT

What triggers the upgrade ultimately for SNX is this file: $CVPNDIR/htdocs/SNX/CSHELL/snx_ver.txt
I presume if this file is modified on the other gateways to the lower version, then the upgrade won't be triggered.

Re: SSL Network Extender - client upgrade upon connection in global properties

the_rock — Wed, 18 Jan 2023 23:49:51 GMT

@PhoneBoy Somewhat unrelated snx extender question...any idea what would cause to show java unavailable when trying to connect via ssl extender? I tried R81.10, R81.20, 3 different machines, even added fw ip to excluded list in java panel, no luck. Java unavailable shows up when I enter creds to connect (shows up after about 30 seconds).

Also tried 4 different browsers, same problem.

Re: SSL Network Extender - client upgrade upon connection in global properties

PhoneBoy — Wed, 18 Jan 2023 23:58:42 GMT

I assume you have the appropriate JDK installed, correct?
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113410

Re: SSL Network Extender - client upgrade upon connection in global properties

the_rock — Thu, 19 Jan 2023 00:03:41 GMT

I do, BUT...I just realized that sk does not have windows 11 listed, maybe thats why its failing...as I tested only on that version. Let me see if windows 10 works.

Re: SSL Network Extender - client upgrade upon connection in global properties

PhoneBoy — Thu, 19 Jan 2023 00:11:31 GMT

Windows 11 isn't supported yet per: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk175324

Re: SSL Network Extender - client upgrade upon connection in global properties

the_rock — Thu, 19 Jan 2023 00:52:38 GMT

No luck even on windows 10. I even downloaded latest JDK (version 19) and tried manual msi install from extender log on page, but when I try it from c/program files(x86)/ssl extender folder, nothing really happens.

Re: SSL Network Extender - client upgrade upon connection in global properties

Daniel_Kavan — Thu, 19 Jan 2023 15:21:27 GMT

Is there a link or page that shows the most recent version of snx available? Not sk104379, but a web page on cp.com that shows it to confirm what's in cat $CVPNDIR/htdocs/SNX/CSHELL/snx_ver.txt

cat /opt/CPcvpn-R81.10/htdocs/SNX/CSHELL/snx_ver.txt

sk168353 show the portal agent, not snx though
800008304

Re: SSL Network Extender - client upgrade upon connection in global properties

PhoneBoy — Thu, 19 Jan 2023 16:15:53 GMT

What's in that file will depend entirely on the version of the gateway in question since we don't generally distribute SNX separate of the gateway itself or a hotfix (JHF or otherwise).
For example, I see some SNX-specific fixes in the most recent JHF (Take 82) for R81.10.
See https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/R81.10/R81.10-List-of-all-Resolved-Issues.htm.
Whether these are gateway specific fixes, client specific fixes, or both, I can't say off-hand.

In any case, I checked my R81.20 installation and see the same version that you specified (800008304).
Which suggests it's a fairly recent version (if not the most recent).

Re: SSL Network Extender - client upgrade upon connection in global properties

AndreiR — Fri, 20 Jan 2023 13:36:06 GMT

Hi @Daniel_Kavan,

80008304 is the latest version of SNX. It is available since R81.10 Jumbo take 55.

SNX itself doesn't require Java runtime. It is needed for deployment and control from Mobile Access Portal page. See sk113410 for more details. Pay attention to supported Java versions and editions.

If you see "Java unavailable" message, it means that Mobile Access Portal Agent can't detect installed Java. Check output of following command in CMD:

java -version

If you see Java version. try to re-install "Check Point Mobile Access Portal Agent". If it doesn't help - better open ticket with support.

Re: SSL Network Extender - client upgrade upon connection in global properties

the_rock — Fri, 20 Jan 2023 13:58:14 GMT

Hey @AndreiR ,

It was actually me that had that issue. Question...I know before you could use ssl extender without needing to have mobile access enabled, is that still the case? I ask, because I get same problem regardless if MA is enabled or not.

Andy

Re: SSL Network Extender - client upgrade upon connection in global properties

the_rock — Fri, 20 Jan 2023 14:54:37 GMT

I actually disabled/re-enabled MA blade and now works fine. Tx a lot!

Cheers,

Andy

Re: SSL Network Extender - client upgrade upon connection in global properties

PhoneBoy — Fri, 20 Jan 2023 14:55:09 GMT

SNX doesn't require MAB to be enabled to use...if they already have SNX installed.
However, the "legacy" SNX portal still uses the legacy deployment method that modern browsers don't support.

Re: SSL Network Extender - client upgrade upon connection in global properties

the_rock — Fri, 20 Jan 2023 14:56:59 GMT

Hey @PhoneBoy ...what do you mean exactly by "if they already have SNX installed"?

Re: SSL Network Extender - client upgrade upon connection in global properties

the_rock — Fri, 20 Jan 2023 17:29:00 GMT

Spoke with one of my colleagues and asked him about it and he said if anything, I may need to downgrade Java to get this to work, so will try that and update : - ). With MA blade on, all works just fine.

Re: SSL Network Extender - client upgrade upon connection in global properties

the_rock — Fri, 20 Jan 2023 18:42:01 GMT

Just to verify for myself, installed older java version and that worked fine, no MAB enabled.

Re: SSL Network Extender - client upgrade upon connection in global properties

PhoneBoy — Fri, 20 Jan 2023 20:36:15 GMT

SNX is typically deployed through a web portal and requires Java to do so.
There are two portals where this can be done:

Mobile Access Blade
Legacy SNX Portal (doesn't require MAB to be enabled)

Mobile Access Blade (as of R80.40) has been updated to allow the Java-based Deployment Agent to deploy SNX on modern web browsers.
The Legacy SNX Portal leverages the legacy NPAPI method, which isn't supported on any current web browser.

It is possible to deploy SNX "out of band" if you're not using Mobile Access Blade (i.e. by installing the relevant CAB file).

Re: SSL Network Extender - client upgrade upon connection in global properties

the_rock — Fri, 20 Jan 2023 21:54:41 GMT

I simply ended up downgrading java version and bam, all worked like a charm : - )

Re: SSL Network Extender - client upgrade upon connection in global properties

Daniel_Kavan — Sun, 22 Jan 2023 20:14:02 GMT

Would you consider just logging into the Mobile access portal (sslvpn) and just using web applications to still be a VPN (sslvpn?) or would you say it's only considered a VPN once you connect with snx and native applications? Or are they both considered VPNs whether you just login to the portal and use a web application or connect with SNX? Or is one considered sslvpn and the other just a reverse proxy?