topic Re: Silent install Check Point Mobile Access Portal Agent in SASE and Remote Access

Silent install Check Point Mobile Access Portal Agent

altu — Thu, 07 Jan 2021 12:44:02 GMT

Hi,

I am trying to install the Check Point Mobile Access Portal Agent (CheckPointMobileAgent.msi) which would allow our users to connect to VPN via the web portal in modern browsers like Chrome, Edge Chromium, etc...

However, during the installation the installer will show a prompt where you would have to allow the installation of a certificate. (screenshot below)

Each time you run the installer a new certificate is generated. The Thumbprint changes.

How should we install this agent silently to a couple of thousands of devices without our users seeing this prompt.

In corporate environments it's not feasible to have to do stuff manually.

Because of this, we are also not able to install the agent during OS Deployment.

I can't find any property in the MSI that would force the import of the certificate without displaying the prompt.

I also can't manually import the certificate with certutil as a new certificate is generated each time the installer runs.

Does anyone have any tips or suggestions?

Thank you

Re: Silent install Check Point Mobile Access Portal Agent

Gaurav_Pandya — Thu, 07 Jan 2021 14:21:28 GMT

Hi,

We have installed JHF on gateway and because of that users were prompting certificate warning. This warning comes first time connect only. We are not getting this warning message every time.

Re: Silent install Check Point Mobile Access Portal Agent

altu — Fri, 08 Jan 2021 09:12:55 GMT

I think you're talking about the prompt to trust the certificate when you try to connect? That's not the problem I'm talking about here.

My issue is with the installation of the Check Point Mobile Access Portal Agent.

Re: Silent install Check Point Mobile Access Portal Agent

PhoneBoy — Sat, 09 Jan 2021 00:29:08 GMT

@AndreiR any ideas here?

Re: Silent install Check Point Mobile Access Portal Agent

altu — Wed, 13 Jan 2021 09:40:34 GMT

Is there anyone that deployed this in their organization?

We can't be the only ones facing this issue...

Re: Silent install Check Point Mobile Access Portal Agent

Fatihah — Wed, 29 Dec 2021 04:14:21 GMT

@altu , yes my side also having this issue.

The users was prompted to re-install the agent everytime they're accessing the mobile access portal.

And currently we haven't find out the solution on this issue. We already reach out to TAC, but the issue still persist.

Gateway ver: R80.40

Hotfix: Take 125

Re: Silent install Check Point Mobile Access Portal Agent

Bac26 — Tue, 14 Feb 2023 11:11:22 GMT

I have same issues furhter more Mobile Access Portal Agent must have java installed on version 81.20?

Re: Silent install Check Point Mobile Access Portal Agent

altu — Tue, 14 Feb 2023 12:24:13 GMT

Everybody has this issue brother.

There is no way to deploy this silently and unattended.

And yes, Java is required as well. I deployed OpenJDK together with the portal components.

The install was interactive. Meaning: I had to ask the users to launch the install themselves and explain what to do with the prompts.

Makes no sense for such a crucial application to be honest. But I found no other way. It was a hassle.

Re: Silent install Check Point Mobile Access Portal Agent

Bac26 — Tue, 14 Feb 2023 12:55:22 GMT

But java is required? because till version 80.30 wasnt...not all wish java installed now..

Re: Silent install Check Point Mobile Access Portal Agent

PhoneBoy — Tue, 14 Feb 2023 15:26:04 GMT

Java has always been required.

Re: Silent install Check Point Mobile Access Portal Agent

Bac26 — Tue, 14 Feb 2023 15:29:04 GMT

for ssl extender too?

Re: Silent install Check Point Mobile Access Portal Agent

PhoneBoy — Tue, 14 Feb 2023 19:09:21 GMT

SNX itself has never required Java.
What does require Java is the deployment agent, which is how SNX is activated from the MAB portal.
Previously, this used Java browser plugins, which have all been deprecated by major browsers.

Re: Silent install Check Point Mobile Access Portal Agent

Bac26 — Wed, 15 Feb 2023 07:14:59 GMT

Because since upgrade 81.10 now MAB ask me java for installation, so what is the best way now? customer doesnt want install java...

Re: Silent install Check Point Mobile Access Portal Agent

altu — Wed, 15 Feb 2023 09:48:43 GMT

Then you won't be able to use the Portal.

You could use the Check Point Mobile client.

Or, install OpenJDK (e.g. Home | Adoptium)

Re: Silent install Check Point Mobile Access Portal Agent

Bac26 — Wed, 15 Feb 2023 09:53:07 GMT

but is just for installation or to operate?

Re: Silent install Check Point Mobile Access Portal Agent

altu — Wed, 15 Feb 2023 09:55:08 GMT

Also to operate...

Otherwise you won't be able to connect via the portal in a modern browser like Chrome or Edge.

It wouldn't also make sense to only be required for the installation 🙂

Re: Silent install Check Point Mobile Access Portal Agent

Bac26 — Wed, 15 Feb 2023 10:05:59 GMT

yes but happens after i upgrade from 80.30 to 81.10 so try understand why was working before without java installed...

Re: Silent install Check Point Mobile Access Portal Agent

Bac26 — Wed, 15 Feb 2023 10:07:05 GMT

we just publish on the portal rdp server to connect to...what would be a workaround? any other possibilities beside installed java on every endpoint?

Re: Silent install Check Point Mobile Access Portal Agent

altu — Wed, 15 Feb 2023 10:18:18 GMT

Because before it was SNX, which worked in Internet Explorer. SNX doesn't require JAVA.

You now have the Deployment Agent, which requires Java to activate SNX from the Mobile Access Portal (MAB) portal.

This then also works from Edge and Chrome browsers.

I agree that it is something that they should do differently. Java requirements should be something from the past. But unfortunately you won't have a choice if you want to use it now.

There is no workaround.

Perhaps you could try to reach out to their support and ask for advice.

Re: Silent install Check Point Mobile Access Portal Agent

Bac26 — Wed, 15 Feb 2023 10:29:30 GMT

ok you mean now SNX need MAB that need java correct? bit confused:)