Checkpoint endpoint & Microsoft Direct Access

[Markus_Hoyer1]

Dear Checkmates,

I am currently facing an issue, where Checkpoint endpoint is disabling Windows Firewall, which would be fine normally, except here the clients are running Direct Access as their VPN'ish solution. 

Direct Access requires that Windows Firewall is enabled to function correctly, therefore I wanted to know whether any have had the same issue and a solution; whether it be a configuration in the Endpoint manager to allow Windows Firewall to be enabled or a workaround to make both work and co-exist. 

Hope you can help. 

Kind regards, 

Markus

[James_Alliband]

Markus,

Firstly thank you for contacting CheckMates.

Investigating everything you have put above, Firstly if you have the Endpoint Firewall Blade running and deployed to the Endpoint. This, as you have experienced will turn off Windows Firewall. At the present moment, this is the way it is configured. 

I have two suggestions for a workout however:

1) You could turn off the firewall blade on Check Point Endpoint using all the other blades you are licensed for & use Windows Firewall for the firewall Element on the Endpoint.

2) You can make a separate virtual group for the users which are using Direct Access. Thus as above then add a rule in the policy and deploy a separate package to these Endpoints excluding Firewall Blade. Allowing Windows Firewall to be turned on, on these specific Endpoints.

Mainly it is about tweaking the policy so it will work for your environment. 

* To be aware, when you turn the firewall blade off. You won't be able to use restrictive mode on the Endpoint. 

Best Regards,
James Alliband

Check Point UK Security Engineer

[Markus_Hoyer1]

Hi James, 

Thanks for the swift reply   greatly appreciated. 

I've come up with a good solution in cooperation with the client.

kind regards, 

Markus

[James_Alliband]

Hi Markus,

That's no problem, we are always happy to help!

If possible, could you share the solution? or an explanation of the solution. It will be useful to hear how you resolved the problem or work around.

Best Regards,
James Alliband

Check Point UK Security Engineer.