Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Contributor

SCV Enforcement Per Gateway (Not Global)

Is there any chance for SCV enforcement per gateway and not global?

It's very problematic to have same rules for different gateways.

For example, I've a customer who has multiple security gateways managed by the same management server.

Now he wants to validate the PCs domain membership for one of the gateways but don't want this requirement to exist on another. I cannot find anyway to workaround this with support.

21 Replies
Highlighted
Admin
Admin

In R80.20? Not that I'm aware of.

0 Kudos
Reply
Highlighted
Contributor

Even in R80.70, or any other possible workaround would be appreciated.

0 Kudos
Reply
Highlighted
Admin
Admin

I've branched this into a new thread in the Remote Access‌ section.

The workarounds I see are:

  • Use a client that explicitly doesn't require SCV to connect to the relevant gateway and enable that option (see below)
  • Exclude the hosts/services that are accessible from that gateway (see below)
  • Put the gateways in different management domains

Can you describe the use case you're trying to support with this request?

Highlighted
Contributor

>> Can you describe the use case you're trying to support with this request?

The use case is pretty simple as described before:

I've a customer who has multiple security gateways managed by the same management server.

Now he needs to validate the PCs domain membership for one of the gateways (some kind of regulation demand), but don't want this requirement to exist on another. (On other gateway even local VPN authentication would be satisfactory.)

The SCV exceptions are not good enough for this, since they are only host and service based - even cannot add networks (adding hundreds of hosts doesn't seem to be a good option).

0 Kudos
Reply
Highlighted
Admin
Admin

If the hosts accessed from each gateway are different, then implement the exclusion workaround above.

It will do the SCV check on the other gateway but still permit access.

Otherwise, you'll have to manage the other gateway with a separate management domain to have different SCV settings at the moment.

0 Kudos
Reply
Highlighted
Contributor

The host are different, but I need to allow whole networks (the other gateway has also S2S VPN to additional gateways and the VPN clients should be able to access those networks too, via this site).

Highlighted
Champion
Champion

SVC can be configured in the SMS local.scv file (see sk41336 and sk38702 for details) that is transmitted to the GW during policy install. As a workaround, it would be possible to edit the file, install policy on the special GW and then undo the edits.

0 Kudos
Reply
Highlighted
Advisor

I've thought of doing the same action described by https://community.checkpoint.com/people/g.alba066e051-da82-3e7a-84e6-2bcbff226984 

0 Kudos
Reply
Highlighted
Contributor

I don't think that this workaround is really usable.
Since it would require doing it again and again (with every change in policy, it would require full attention for this issue).

I'm wondering if there is someone out there who is really uses this SCV feature in a real work scenario.

Or if there is any other way to accomplish the task (of letting only domain joined computer to be able to connect via VPN)

0 Kudos
Reply
Highlighted
Admin
Admin

The part that seems to be unique to your customer is having different gateways managed by the same domain with different SCV policies.

Most organizations that implement SCV do so for all their gateways, not just for specific ones. 

Highlighted
Contributor

Ok, let's say that what you say that's the mainstream.

What about different policies for different users? Is that also something extraordinary?

0 Kudos
Reply
Highlighted
Admin
Admin

There are usually minimum standards to apply to all users who connect, regardless of who they are.

There might be some different standards based on who the user is and what they access.

Mobile Access Blade with Endpoint Security on Demand offers the kind of granularity you're looking for, but that's a different mechanism from SCV.

0 Kudos
Reply
Highlighted
Contributor

Well I'm aware of the Mobile Access Blade and the Endpoint Security on Demand.

But my feeling is that the MOB is a product that is not being developed for years. It's even abandoned (not yet included) from the R80.10 GUI.

0 Kudos
Reply
Highlighted
Admin
Admin

While there are some features/functions of Mobile Access that require the old SmartDashboard in R80.x, we actually support unified policies that include Mobile Access in R80.10.

In terms of major features, we've developed Reverse Proxy functionality and there has been some work done to replace the need for Java for SNX (because browsers stopped supporting it).

So to say that Mobile Access Blade hasn't had development in years is not true.

0 Kudos
Reply
Highlighted
Contributor

Hi @PhoneBoy,

Hope you are doing good.

Need assistance on SCV for R80.30 SMS and Gateway, as we are planning to implement Domain Membership Validation using SCV checks.

We have Checkpoint Gateways in Multiple Regions with Remote Access VPN on each gateway (all managed by the same SMS), the domain for machines in each region are different from each other.

So wanted to confirm if we have an option to deploy Domain Validation specific to each gateway.

 

 

0 Kudos
Reply
Highlighted
Admin
Admin

That is described by this comment: https://community.checkpoint.com/t5/Remote-Access-VPN/SCV-Enforcement-Per-Gateway-Not-Global/m-p/214...

Or you could include a check for all relevant domains on all gateways?

0 Kudos
Reply
Highlighted
Contributor

Thank you @PhoneBoy  for your quick response as usual.

I tried to add all the domains to the Registry Monitor, but it does not work, could you confirm if the below script I am using is correct:

: (RegMonitor
:type (plugin)
:parameters (
:string ("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\MachineDomain=abc.domain")

:string ("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\MachineDomain=def.domain")
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Your computer doesn't meet the domain membership requirements.")
:end (admin)
)

 

 

0 Kudos
Reply
Highlighted
Admin
Admin

This condition can't possibly work because both conditions can't possibly be true at the same time.
Also, you don't need to include HKEY_LOCAL_MACHINE\ as that's assumed.
Probably something like:

 

: (RegMonitor
  :type (plugin)
  :parameters (
    :begin_or(or1)
      :string ("SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\MachineDomain=abc.domain")
      :string ("SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\MachineDomain=def.domain")
    :end(or1)
    :begin_admin(admin)
      :send_log(alert)
      :mismatchmessage("Your computer doesn't meet the domain membership requirements.")
    :end(admin)
)

 

Refer to the E80.60 / E80.61 / E80.62 / E80.64 Remote Access Clients for Windows OS Administration Guide for additional syntax on SCV.

 

0 Kudos
Reply
Highlighted
Contributor

Hi @PhoneBoy,

I tried using the above lines in the local.scv file but the the policy install failed, error message "Failed to merge SCV policies. Local SCV file may be corrupt".

Attached the screenshot for your reference.

 

 

 

0 Kudos
Reply
Highlighted
Champion
Champion

Correct line endings are present ? Compare it with the original files copy to be sure...

0 Kudos
Reply
Highlighted
Contributor

Hi @G_W_Albrecht ,

Yes I have verified the config with the original file and it looks fine, attached the local.scv file. 

 

0 Kudos
Reply