how to allow only newer versions of VPN client to login on the VPN

[NunoP]

Hello Checkmates,

I have a customer which haves SCV implemented in the VPN client with some rules configured. They now want to add another layer of protection and allow only the newer versions of the Checkpoint mobile client to connect to the RA VPN.

Can you let me know how to implement this?

GAIA version is R80.40.

Thank you.

[NunoP]

After digging a bit about this and reading the Remote access VPN R80.40 Administration Guide, came to this script:

: (RegMonitor

                   :type (plugin)

                   :parameters (

   :keyexist ("HKEY_CURRENT_USER\SOFTWARE\CheckPoint\Mobile Access Portal Agent\")

   :string ("SOFTWARE\CheckPoint\Mobile Access Portal Agent\Version>=E84.60")

   :send_log (alert)

   :mismatchmessage ("A versao minima suportada do cliente VPN e E84.60 ")

   :end (admin)

                    )

)

Can someone share an opinion with me.

thank you.

[G_W_Albrecht]

Yes, you can check on Windows which RA client version is installed and disallow connection based on that.

[NunoP]

Hi,

do you mean disallowing older versions based on GPO for exemple? 

The problem is that not all laptops are on the client´s domain.

Thank you.

[PhoneBoy · Accepted solution]

Right, the SCV method you mentioned can work in this case.
That said, it is only supported for Windows clients (Mac clients do not currently support SCV).

[Howard_Gyton]

Is there a way of disabling SCV for Mac only?  Or a VPN client that doesn't care about SCV, and here I don't refer to SSL VPN/SNX.

[PhoneBoy]

You can allow clients without SCV to connect.
See: https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN...