On 1 April 2020, @Robert_Elliott and @Allen_Fambro did a great session on Remote Access Best Practices!
Content available to CheckMates members:
Selected Q&A asked during the session will be added below as comments shortly.
See also the following resource pages:
SNX itself doesn't require Java, but the cross-platform Mobile Access Blade Deployment Agent (MABDA) that deploys the SNX and Compliance Check components does. There is no specific timeline for implementing MABDA without Java currently, though alternatives are being investigated.
We have two community posts about how to set up and use strongSwan (Roadwarrier) and Libreswan 3.23 with R80.30, both written by @Soeren_Rothe. There is also official support for Strongswan through a Customer Release that you can obtain through your local Check Point Office.
This can be done with MEP (Multiple Entry Point) configurations. Refer to the product documentation links above.
Licensing and hardware capacity, both of which are discussed in our Remote Access Whitepaper.
Yes, it varies by client, access method, and gateway version. You can see the different options listed in sk86240. Note that most third-party providers (Duo, Okta, etc) will integrate using RADIUS.
This can be achieved using SNX or the Mobile Access Blade Portal.
Three reports are provided in our Short List of Remote Access VPN Resources page. These reports require SmartEvent. There are some CLI-based options as well.
Configure your Remote Access VPN Community to include the VPN Community of the remote site. This is done on the gateway object. In R80.40, it looks like this:
In releases prior to R80.40, it looks a little different, but similar:
In the specific gateway object(s), you will configure what LDAP Groups are allowed to connect.
Note these specific LDAP Groups must be defined in the management.
Yes. If you are not using Mobile Access Blade:
With Mobile Access Blade:
These sorts of checks can be done with SCV (see sk147416) or Endpoint Compliance checks, as described in the product documentation links above as well as the Endpoint Security Admin Guide.
This can be configured, yes. Refer to the product documentation links above.
In this case, you may wish to provide access using RDP over an HTML5 using Guacamole or a similar proxy solution with Mobile Access Blade. @Shay_Levin produced a video that shows how to set up RDP with Mobile Access Blade Step-By-Step. This will prevent copy/paste between the local and remote system as well.
Yes, see this thread.
Mobile Access licenses plus the number of Endpoint Security VPN/SBA licenses you have.
SandBlast Agent (and Remote Access VPN licenses) are meant for managed VPN endpoints. If you have unmanaged VPN endpoints connecting (either via SNX, IPSEC, or through the Mobile Access Porta), then yes, you will need Mobile Access licenses.
No, there can only be one Remote Access community for all gateways managed as part of the same management domain. Use Access Rules to control which users can connect to which networks.
If you enable Route All Traffic, all Remote Access users will have their traffic routed through the VPN by default. You can allow some clients (by group) to disable this, as described in sk114882.
Yes.
Windows Users can connect using Check Point Mobile client using a Mobile Access Blade license for the number of concurrent users expected.
Mac clients requiring IPsec access need the full Endpoint Security VPN, which is licensed per installed seat. This can be provided through current SandBlast Agent licenses or legacy CPEP-ACCESS SKUs.
This is discussed in the Quick Primer on Configuring Your Gateway on SecuRemote.
This is set in the Office Mode configuration:
This is a setting in Global Properties and it should apply to all Remote Access clients:
SNX can be downloaded from one of two places:
| User | Count |
|---|---|
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Fri 10 Jan 2025 @ 10:00 AM (CET)
CheckMates Live Netherlands - Sessie 32: Infinity External Risk Management (CyberInt)Fri 10 Jan 2025 @ 10:00 AM (CET)
CheckMates Live Netherlands - Sessie 32: Infinity External Risk Management (CyberInt)
.png "Wolfgang"){kind=avatar}
