topic Re: Checkpoint VPN Scripted Install & Options in Spark Firewall (SMB)

Checkpoint VPN Scripted Install & Options

sx8n20394 — Wed, 12 Mar 2025 17:49:25 GMT

I am looking for some help with a couple of different things related to the Checkpoint VPN install. I am trying to script an install for the Checkpoint VPN but I am running into some issues and need some things clarified. Just FYI, I am familiar with the Remote Access VPN Clients for Windows Administration Guide.

1. I do not see an option in the MSI switches to install Checkpoint Mobile VPN only. I can only install the Endpoint VPN. Are there any options to just install Checkpoint Mobile for Windows?

2. Is there a huge difference between the Mobile VPN for Windows and Endpoint Security VPN if we are just running locally managed SMB spark devices? I see in the documentation it mentions an Integrated Desktop Firewall and SCV integrations with Windows Security Center. The problem is that all of the configuration for those items are done by a SmartConsole management server which we don't use.

3. Is there any way to create a configuration file or modify the MSI if we aren't using a SmartConsole management server? Everything I see references SmartConsole deployment.

I may add on to this post but these are the questions I have for now.

Re: Checkpoint VPN Scripted Install & Options

CaseyB — Wed, 12 Mar 2025 19:15:52 GMT

Have you seen this SK?

sk122574 - VPN Configuration Utility for Endpoint Security Clients for Windows

Re: Checkpoint VPN Scripted Install & Options

G_W_Albrecht — Thu, 13 Mar 2025 10:47:46 GMT

This is the solution - opt for SmartConsole Managed and Mobile StandAlone RA VPN client Endpoint Security VPN for Windows ! With Mobile, SmartConsole is not necessary.

See https://community.checkpoint.com/t5/Remote-Access-VPN/Changing-the-Standalone-Remote-Access-Client-flavor/m-p/39494

But you need not use the registry - in the instructions here https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/Editing-TTM-File.htm?tocpath=The%20Configuration%20File%7C_____1

you can change enable_firewall to false in Remote Access TTM Configuration on GW:

Description: Enable/disable desktop firewall.

Type Valid values Default value Available from Available on

string true / false / client_decide true E84 Windows, macOS

Type	Valid values	Default value	Available from	Available on
string	true / false / client_decide	true	E84	Windows, macOS