Managing endpoint clients when they are outside of the LAN

[s_milidrag]

Hi 

For the purpose of managing endpoint clients when they are outside the Local network with an on-prem management server, I have had to expose the management server to the Internet (static NAT) and create a firewall rule to allow only HTTPS communication.

Is this safe, since I see a lot of connections & attack attempts on my EP SMS?

Endpoint SMS is behind the Check Point firewall, and I am also using the same SMS to manage firewalls.

Thanks 

[Chris_Atkinson · Accepted solution]

Likely you qualify for an "Endpoint Policy server" license that you can put in the DMZ as an alternative if you would prefer.

[s_milidrag]

Thanks,

I think this is the only reasonable setup

[the_rock]

What Chris said definitely makes sense.