Differences between Endpoint Protection Advanced Remote Access VPN vs Mobile Access Blade VPN

[xxxrcearx]

The customer is currently using Endpoint Protection Advanced and, following headquarters' direction, plans to migrate to Microsoft Defender for Endpoint for endpoint protection.

The existing environment includes Check Point 9000 Series Security Gateway. As Microsoft Defender for Endpoint cannot coexist with the current endpoint protection solution on the same device, I am considering proposing the Mobile Access Blade license on the Security Gateway to replace the existing endpoint solution's remote access VPN (IPsec) functionality.

Based on the Check Point article (Check Point SK67820), it appears that Check Point Mobile for Windows IPsec VPN connectivity requires both the IPsec VPN and Mobile Access Software Blades to be enabled on the Security Gateway.

I would appreciate clarification on the following:

1. Is Check Point Mobile for Windows the same as Endpoint Security VPN?
2. Is a separate IPsec VPN license required for the Security Gateway, or is it included as part of the existing gateway licensing?

[ThomasH]

First - Licensing:

IPsec VPN is included in the FW license, so there is no additional license needed. 
For the remote access, you either need the Mobile Access (MOB) license on each gateway with a corresponding concurrent user amount. Or you order the Endpoint Access Control license (CPEP-ACCESS) for the amount of users independent of the number of gateways.

Second - Client:

To use just the Remote Access, there is the Enpoint Security VPN client, that can be installed in 3 ways:
1. Endpoint Security VPN (correponds to the CPEP-ACCESS license)
2. Check Point Mobile (corresponds to the Mobile Access license)
3. SecuRemote (no license needed, but also no OfficeMode feature - so ignore this option)

[PhoneBoy]

IPsec VPN has been included as part of the basic license for a couple of decades now.
At some point, we added a MOB-5 to the basic license that allows you to use Mobile Access functionality for up to five users.
Mobile Access functionality includes "Check Point Mobile" Remote Access functionality (does not include Firewall or Compliance that CPEP-ACCESS or other Endpoint features). 

In terms of activating the functionality for Remote Access VPN, you can activate either VPN or Mobile Access on the gateway.
Mobile Access is only required if you are using the web portal/reverse proxy features.