topic Re: SNX deployment shell in SASE and Remote Access

SNX deployment shell

ggiordano — Mon, 30 Nov 2020 14:23:06 GMT

Every time I upgrade a gateway with MAB activaetd, I have the problem how to manage the upgrade request that the users have when they connect to the MAB for the first time.

The issue is related the users are request to upgrade their MAB components (SNXDeploymentShell is the first), but they haven't admin right on their own computer.

the result is the users are request to insert administrator credential otherwise they cannot connect to VPN.

In many environment I don't have a software distribution solution for pushing the new version on remote computers and manually, one-by-one, I need to insert admin credential for going on.

today, for this reason, about 200 users weren't able to connect to VPN.

In addition, before the upgrade, I don't have the right version of the MAB components because I'm able to retrieve them only when I have a gateway updated.

No option to disable the force to update the components.

I'd like to understand how you approach to the gateway upgrade and why CKP won't include the capability to choose if I want to upgrade the components or not.

Re: SNX deployment shell

G_W_Albrecht — Mon, 30 Nov 2020 14:45:59 GMT

This can be disabled in Global Properties:

Re: SNX deployment shell

ggiordano — Mon, 30 Nov 2020 14:53:36 GMT

it's related to SNX extender and not SNXDeploymentShell.

the TAC confirms you cannot choose and currently it's mandatory to upgrade the SNX Deployment shell

Re: SNX deployment shell

MaksimBahunou — Tue, 01 Dec 2020 11:51:42 GMT

Hi @ggiordano

Could you clarify what actions were done before your users started receiving update requests, please? Maybe you made gateway upgrade or something like this?

Regards, Maksim.

Re: SNX deployment shell

ggiordano — Tue, 01 Dec 2020 13:07:00 GMT

As per my description, every time I perform an upgrade, the SNXDeploymentShell must be updated on the remote computers want to connect to by VPN

Re: SNX deployment shell

MaksimBahunou — Tue, 01 Dec 2020 15:43:58 GMT

Sorry for the annoying questions, but I want to make sure that we are talking about same things.

Saying 'upgrade' you mean version upgrade, say from R80.20 to R80.30, do you?

Could you elaborate what is "SNXDeploymentShell", please? There are two components that can be updated during upgrade: Portal Agent and SNX. I want to know for sure what component causes the problem.

Regards, Maksim.

Re: SNX deployment shell

ggiordano — Tue, 01 Dec 2020 16:20:05 GMT

in this last case, the upgrade was from R80.10 to R80.30

The SNXDeploymentShell is the component required when you start the connection by SNX network mode from Mobile Access Portal

it's included in extender.cab

Re: SNX deployment shell

MaksimBahunou — Wed, 02 Dec 2020 06:55:41 GMT

I see.

New version includes updated Portal Agent. In your case it is an self-updatable ActiveX component. And it requires admin rights for installation.

I can suggest you the following:

look for a way to install ActiveX for non-admin users (using GPO, for example)
try Java based Portal Agent. It does not require admin rights for installation / update (but Java runtime does). More info in sk113410
open a support ticket

Regards, Maksim.