topic Re: Enable device posture assessment to connect RA VPN in SASE and Remote Access

Enable device posture assessment to connect RA VPN

Ob1lan — Tue, 01 Jun 2021 14:12:46 GMT

Hi,

Our management came with a new requirement : to be able to do device posture assessment/healthcheck before allowing to connect our Remote VPN gateways.

I'm a bit confused about the licenses needed for this, what needs to be configured on the gateways, and what client software is needed.

Currently, we use Endpoint Security VPN Standalone, and our VPN gateways are installed with R80.30.

Here is what I see on the licenses details for one of our gateway:

Basically we would like to avoid devices without certain OS patches, certificate installed, etc... to connect our network. Also, would be great to allow policies to be applied to AD groups.

Could someone advise on that, is there a guide somewhere ?

Thanks in advance !

EDIT : we have both Windows and MacOS clients, and would like to have the same kind of security checks features for both OS.

Re: Enable device posture assessment to connect RA VPN

Ruan_Kotze — Tue, 01 Jun 2021 12:41:45 GMT

Check Point calls this Secure Configuration Verification (SCV).

The whitepaper linked here is a pretty good starting point. There is also sk147416 which contains a wealth of information and examples.

Lastly - I wrote a blog post with step-by-step examples on how to do simple SCV (domain membership check) using only the standalone VPN client and a Check Point gateway.

Hope it helps,
Ruan

Re: Enable device posture assessment to connect RA VPN

PhoneBoy — Tue, 01 Jun 2021 13:49:25 GMT

SCV as described by @Ruan_Kotze is one option, which is supported with Mobile Access licenses.
The other option is Endpoint Compliance, which requires either an ACCESS license or one of the Harmony Endpoint/SBA SKUs.
This offers a bit more granularity and also supports Mac clients.
It requires using Endpoint Management

Re: Enable device posture assessment to connect RA VPN

Ob1lan — Tue, 01 Jun 2021 14:00:41 GMT

Thanks a lot. So SCV doesn't support MacOS at all ? Also, Endpoint Management is something I need to install in the CMA or a standalone instance ? I'll check what license level we have and what can be done.

Re: Enable device posture assessment to connect RA VPN

Ob1lan — Tue, 01 Jun 2021 14:12:05 GMT

Thanks, I'll consider those ressources carefully. Something I missed in my original request is we have both Windows clients and MacOS clients. I believe SCV only works for Windows ? How to handle same level of security checks for MacOS clients ?

Re: Enable device posture assessment to connect RA VPN

PhoneBoy — Tue, 01 Jun 2021 14:59:24 GMT

SCV currently does not support Mac, correct.
This will require the use of Endpoint Compliance (and Endpoint Management).

Endpoint Management can be acquired a couple different ways:

It's included in modern management SKUs (just needs to be enabled)
If you want to run on a separate system from your network management, it requires a separate license
If you purchase(d) SBA or Harmony SKUs, Cloud-based management is included

Re: Enable device posture assessment to connect RA VPN

Ob1lan — Tue, 01 Jun 2021 15:03:32 GMT

Ok got it. Then I'll have a look at Endpoint Compliance.

So for the licensing model, does that mean we can enable that on our SMS recently upgraded to R81 ? Or does the sentence 'modern management SKU' refers to something else.

If it can be enabled on our Management appliance, is that recommended ? Or is it preferable to have it separated ? Do you have any requirement that would allow us to determine if our appliance is sized appropriately to host Endpoint Management ?

Thanks !

Re: Enable device posture assessment to connect RA VPN

PhoneBoy — Tue, 01 Jun 2021 15:14:51 GMT

The output of cplic print on your management can determine if you're licensed for Endpoint Management or not.
In terms of sizing, it will obviously require more memory to also run Endpoint Management.
However, given you'd be using it only for Endpoint Compliance, the overall impact should be minimal.
If you're using other Endpoint Management features, I'd separate them.

Your Check Point SE should be able to provide more specific guidance for your situation.