topic Mobile VPN Access - Client Certificate: Forgot Password (1st Line Support) in SASE and Remote Access

Mobile VPN Access - Client Certificate: Forgot Password (1st Line Support)

PointOfChecking — Wed, 05 May 2021 14:15:33 GMT

Hi,

We're looking to pass the "reset password" job to 1st line support to generate new client certificates on R80.40.

How would we go about doing this, without giving them authority to the rest of the FW MGMT?

As I'm aware, we currently do this via the Mobile Access tab in SmartDashboard.

Thanks

Re: Mobile VPN Access - Client Certificate: Forgot Password (1st Line Support)

PhoneBoy — Fri, 07 May 2021 18:11:46 GMT

The administrator profile for the relevant users likely needs the following two permissions:

Check Point Users Database
Client Certificates

Re: Mobile VPN Access - Client Certificate: Forgot Password (1st Line Support)

PointOfChecking — Mon, 10 May 2021 07:00:48 GMT

PhoneBoy,

Thanks as usual!

So I assume, I would need to install SmartConsole for 1st Line Support?

Is there another EXE program which they could use that directly takes them to the Certificate management page?

For example, I know running "%PROGRAMFILES(X86)%\CPAppStart.exe" 3 will start SmartView Monitor.

Is there another "Number" I could use to start SmartDashboard > Mobile Access Tab?

Again, we're using R80.40

Thanks.

Re: Mobile VPN Access - Client Certificate: Forgot Password (1st Line Support)

G_W_Albrecht — Mon, 10 May 2021 11:46:09 GMT

Not really - link to FwPolicy.exe to open the legacy Dashboard with MAB Tab.

Re: Mobile VPN Access - Client Certificate: Forgot Password (1st Line Support)

PointOfChecking — Mon, 10 May 2021 12:47:47 GMT

That's great! 😀

Thanks for that. I've found that exe in the program files folder, but how could I get this onto 1st line supports' machines without installing the full SmartConsole?

I've tried copying the EXE, CHM and .exe.config files onto a test machine, but I seem to be still missing something.

Re: Mobile VPN Access - Client Certificate: Forgot Password (1st Line Support)

G_W_Albrecht — Mon, 10 May 2021 12:59:03 GMT

No way - you have to install full or portable SmartConsole on every client.

Re: Mobile VPN Access - Client Certificate: Forgot Password (1st Line Support)

PointOfChecking — Mon, 10 May 2021 13:01:57 GMT

Thanks Mr.

I'll follow this advice.

Thanks.

Re: Mobile VPN Access - Client Certificate: Forgot Password (1st Line Support)

PhoneBoy — Mon, 10 May 2021 15:19:12 GMT

The other option would be to use the API and write whatever front end you’d like.
The relevant API bits are discussed here: https://community.checkpoint.com/t5/API-CLI-Discussion/Creating-user-a-certificate-via-API/m-p/99996#M5256

Re: Mobile VPN Access - Client Certificate: Forgot Password (1st Line Support)

PointOfChecking — Mon, 10 May 2021 15:38:25 GMT

Thanks. Interesting article, but not worth investing that kind of time for our environment. 😊

Appreciate the link though!