Remote Access VPN Configuration for Desktop/Laptops

[_Val_]

Author: @Gregg_Sietsema 

Introduction

This document provides step by step instructions for setting up a Remote Access VPN with Check Point R80.x. Some prior experience with setting up Check Point environment is assumed, and also basic understanding of IPSec VPNs principles.

Our objective is to enable a Layer 3 Remote Access solution using a VPN agent installed on a Desktop/Laptop (Endpoint Security VPN for Mac/PC, Check Point Mobile for Windows, or SecuRemote).

To assign different levels of access in active directory, an HR and an Engineering group have been created.

Depending on the group a user is a member of they will be given different access into the environment.

Note: Client-side settings are not covered.

Configuring VPN

1. Enable Mobile Access Blade to start Mobile Access Configuration Wizard

2. Unselect all options except for Desktops/Laptops (we are only going to configure the VPN for these endpoints)

3. If your domain is not already listed, select Create new domain and add the required domain information and click "Connect".

4. Select "Finish"

5. Add gateway to RemoteAccess VPN Community if not already there.

6. Enable Desktop/Laptop VPN Clients

7. Enable Identity Awareness

8. Then select "Terminal Servers"

9. Select "I do not wish to configure an Active Directory at this time".

10. Click on "Finish" and then go into Identity Awareness and uncheck Terminal Servers and confirm Remote Access is checked.  The reason for this step is to enable identity awareness for Remote Access so we can apply policy to users based on their AD group.

11. Create an Access Role for both HR and Engineering. From the object tree select New > More > User > Access Role.  In the Users section, add the AD Security group that the users of this group are members of.

12. Create access rule allowing Engineering group to allowed destination and HR group to their allowed destination with RemoteAccess in the VPN Community column and Install Policy.

13. Install VPN agent and configure required settings using the wizard.

References

sk67820 - Check Point Remote Access Solutions

sk117536 - Endpoint Security Homepage