Endpoint Security on MacOS make proxies software not working

[Ob1lan]

Hi, 

We've got several users complaining about a strange behavior. They are all Mac users, and have to use some proxies debuging tools software (MITMProxy, Charles Proxy) for their work.

More than 10 of them reported these tools no longer work if the Check Point Endpoint Security is installed, regardless of VPN connection state. If they uninstall the Endpoint Security tool, it works again.

Have any of you ever heard of this ? They need both software installed as most are now working from home. They also reported it still works with both for some users, regardless of MacOS version.

Thanks in advance for your help !

Regards,

Antoine

[G_W_Albrecht]

Please explain if this is is managed by an EPS Server or a StandAlone VPN client. Be sure to use the newest Mac Version E83.20 client. That it works for some users sounds like there are reasons it does not work for others, but should work for all. Maybe involve TAC ?

[Ob1lan]

Thanks for your reply. This is used to connect our office (Remote Access VPN). I'll check if there is a correlation with software version, and maybe ask them also to test a previous version.

[Kobie_Bendalak]

What blades are they using? Have you tried excluding this application?

Either way, I suggest you'll go through TAC as they can surely help in such cases.

[Ob1lan]

Thanks for your answer. They are simply using the Endpoint Security software for Remote Access VPN to our office. How can I exclude the relevant application ?

I'll involve TAC if I can't find a solution by myself in a timely fashion. 

Thanks !

[G_W_Albrecht]

If you do not have an Endpoint Security Server installed and use E83.20 Check Point Endpoint Security Client for macOS, you have E83.20 Endpoint Security VPN for macOS only - no way to exclude anything here, only to disable the Desktop firewall...

[Ob1lan]

Hi,

So to recap our investigation : it's not working with E82.00, E82.50 and E83.20. For some users it does work, but for most of them it doesn't.

We made them try E80.89, and they do not have any issue with their tools.

So right now looks like we have a workaround, but I'd like to pinpoint the actual issue to avoid having users to use that old version for too long.

Any idea what I should look for next ?

Thanks in advance.

Regards,

Antoine

[G_W_Albrecht]

Do the few users it does work for share something ? I would look at the differences first...

[Ob1lan]

They seem to have mixed OS version, and reported that it's possible for 2 users having same OS version and same VPN client version to have different behavior : it can work alright for one of them, and not for the other one... But for all of them, there is no issue with E80.89... 

[G_W_Albrecht]

If software behaves different for different users there always is a reason for the behaviour, even if we do not know it. But anyway, E80.89 is not a bad choice if you only need the VPN part of EPS and no macOSCatalina. 

[PhoneBoy]

I’m going to guess it’s the desktop firewall that’s the issue.
See: https://community.checkpoint.com/t5/Remote-Access-VPN/MacOS-EPS-Standalone-Client-VPN-client-Block-A...