topic Re: SVC logs in SASE and Remote Access

SVC logs

Sergey_Anikeev — Wed, 25 May 2022 13:59:05 GMT

Colleagues, hello!
Can you tell me, if it is possible to see the failed test SCV events in the gateway side logs?
We need "Not compliance" events on the user side to be displayed in the log server.

We use Secure Configuration Verification (SCV) for MAB VPN clients.

Re: SVC logs

G_W_Albrecht — Wed, 25 May 2022 14:16:58 GMT

According to sk147416 - Secure Configuration Verification (SCV) this should be possible!

Re: SVC logs

Sergey_Anikeev — Wed, 25 May 2022 14:49:57 GMT

I have configured this SK, however, all that I see is ->

Re: SVC logs

G_W_Albrecht — Wed, 25 May 2022 18:05:04 GMT

Sorry, i missed that you use SSL VPN (MAB) - SCV is only possible using IPSec VPN clients that enforce a Desktop policy.

sk147416: The compliance checks is supported by Endpoint Security Client, Check Point Mobile for Windows, Full Suite version. According to Remote Access Clients for Windows 32/64-bit Administration Guide E80.72 and Higher (page 13).

Re: SVC logs

Sergey_Anikeev — Wed, 25 May 2022 19:26:15 GMT

I apparently did not write exactly.
We use Mobile Access VPN Clients for Windows

Re: SVC logs

G_W_Albrecht — Mon, 30 May 2022 08:07:16 GMT

You must use the first option. EPS VPN ! SCV is only possible using IPSec VPN clients that enforce a Desktop policy. CP Mobile has no Desktop Policy (see sk73600 - Check Point Mobile fails to connect due to SCV and firewall policy check sk147416 - Secure Configuration Verification (SCV)).

Re: SVC logs

Sergey_Anikeev — Mon, 30 May 2022 08:18:52 GMT

However, in this client I have a check.

1. A certain process is launched (the check was successful)

2. If a certain process is not found (the check was not successful):

Accordingly, the client either receives access via VPN or not.

Re: SVC logs

G_W_Albrecht — Mon, 30 May 2022 08:41:21 GMT

This was what i could find - i know that sk67820 lists Security Verification for Endpoint Devices also with Mobile and MAB / SNX, but sk73600 - Check Point Mobile fails to connect due to SCV firewall policy check and sk147416 - Secure Configuration Verification (SCV) state that SCV is only possible using Desktop policy. So better ask TAC !

Re: SVC logs

Sergey_Anikeev — Mon, 30 May 2022 08:43:43 GMT

Thank you!

Re: SVC logs

si-infra-trt5 — Thu, 10 Aug 2023 18:36:30 GMT

Hello,

We´re planning to apply SCV in our environment in our organization. We would like to collect failed test SCV events centrally so we can view these events in Log View.

I checked sk147416 but it says "Deleted. This SK no longer exists".

Is this is information about viewing failed SCV logs in other documentation?

Thank you

Re: SVC logs

_Val_ — Fri, 11 Aug 2023 10:50:02 GMT

The SK is deleted because the info is moved to the RAS Client Admin guide: https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/SCV.htm?tocpath=Secure%20Configuration%20Verification%20(SCV)%7C_____0

Re: SVC logs

rochim — Tue, 18 Mar 2025 07:57:48 GMT

Hi Val,

output from your link is not found.

any update for this topic?

if it is possible to see the failed test SCV events in the gateway side logs?
We need "Not compliance" events on the user side to be displayed in the log server and create the report from that log.