Differences between Endpoint Protection Advanced Remote Access VPN vs Mobile Access Blade VPN

[xxxrcearx]

The customer is currently using Endpoint Protection Advanced and, following headquarters' direction, plans to migrate to Microsoft Defender for Endpoint for endpoint protection.

The existing environment includes Check Point 9000 Series Security Gateway. As Microsoft Defender for Endpoint cannot coexist with the current endpoint protection solution on the same device, I am considering proposing the Mobile Access Blade license on the Security Gateway to replace the existing endpoint solution's remote access VPN (IPsec) functionality.

Based on the Check Point article (Check Point SK67820), it appears that Check Point Mobile for Windows IPsec VPN connectivity requires both the IPsec VPN and Mobile Access Software Blades to be enabled on the Security Gateway.

I would appreciate clarification on the following:

1. Is Check Point Mobile for Windows the same as Endpoint Security VPN?
2. Is a separate IPsec VPN license required for the Security Gateway, or is it included as part of the existing gateway licensing?

[ThomasH]

First - Licensing:

IPsec VPN is included in the FW license, so there is no additional license needed. 
For the remote access, you either need the Mobile Access (MOB) license on each gateway with a corresponding concurrent user amount. Or you order the Endpoint Access Control license (CPEP-ACCESS) for the amount of users independent of the number of gateways.

Second - Client:

To use just the Remote Access, there is the Enpoint Security VPN client, that can be installed in 3 ways:
1. Endpoint Security VPN (correponds to the CPEP-ACCESS license)
2. Check Point Mobile (corresponds to the Mobile Access license)
3. SecuRemote (no license needed, but also no OfficeMode feature - so ignore this option)