Mobile Access Blade on a Centrally managed SMB 1490

[MrSalazar]

Hi, 
Maybe somebody had already this issue, after the Upgrade from the Mgmt Server is not possible to enable the Mobile Access Blade on a SMB 1490.
Locally managed it is posible but the Idea of Central Managed is not. 
Any suggestion? maybe is a Bug or maybe the incorrect way how to activate it. 

[G_W_Albrecht · Accepted solution]

You do not give details of what you try to do here - on SMB, no MAB Portal is available, so you only have SNX /SSL VPN RA clients and  SSL VPN Bookmarks (links or RDP). You are unable to activate MAB in Dashboard, all you can do is activate SNX RA VPN clients in VPN Clients > Other. This is also true  for R80.20.01 15x0 devices !

Check Point R77.20.xx for 600 / 700 / 1100 / 1200R / 1400 / 910 Appliance Features and Known Limitations &

Check Point R80.20 for 1500 Appliances Features and Known Limitations :

Mobile Access Blade

Partial

Partial

All

Remote access clients are supported (Endpoint, SNX).  Mobile Access Web Portal is not supported.

[MrSalazar]

Hi @G_W_Albrecht,
So that explains why this option on the Gateway Object in the SmatConsole is greyed out, so if we have license for MAB, that means SNX or Endpoint?

[G_W_Albrecht]

A MAB license is a blade license bound to a GAiA gateway - and Embedded GAiA 1490 appliances do neither have the MAB blade nor any MAB license at all ! So that means SNX or Endpoint, yes...

[MrSalazar]

Thank you ver much

[PointOfChecking]

Hi,

I am trying to do the same on an 1800 quantum appliance. On the marketing material it says it has mobile access.

also, in my GW object it shows as available.  however, I just can't click on it to enable as it's greyed out.

[Wolfgang]

Same with 1800 and 1600 appliances as with 1490, all embedded GAiA appliances have no MOB blade. Only SNX and remote vpn capabilities available.

[PointOfChecking]

Thank you.

Can you point me in the direction of "remote vpn capabilities" please? 

Thank you.

[G_W_Albrecht]

[PointOfChecking]

Thanks, how do I enable that option?  I don't have it.

It's centrally managed (by Smart-1 R80.40) running R80.20

[G_W_Albrecht]

[PointOfChecking]

EDIT*  I should enable IPSec VPN not Mobile Access.  Sorry, I have enabled and I can see the options now.  Thanks.

[PointOfChecking]

*edit* This was posted before the above posts in conversation.

I have realised I used the wrong terminology.  I am looking to enable Remote Access as below photo.  Where do I go to enable this?

[PhoneBoy]

Since your SMB appliance is centrally managed, this is configured on your management.
If you've pushed a policy to your SMB gateway that includes Remote Access VPN configuration (for example a Remote Access Encryption Domain), I would expect that to be enabled.
If it's not, then it might just be a cosmetic bug and it should be taken with the TAC.

[PointOfChecking]

Hi PhoneBoy,

Thanks, but I have it enabled now.

The "VPN OFF" post was posted before the other comment.

Thanks for the advice anyway 🙂 

[Exonix]

hello all,

unfortunately, I did not follow the logic of the solution, can you tell me - what am I missing to centrally enable "Remote Access" and IPSec for S2S on Spark 1900?

Tnank you!

[PhoneBoy]

If your 1900 is centrally managed, you've already done it.
IPsec VPN also enables Remote Access via IPsec and SNX.
Mobile Access Blade (only needed for the Web Portal) is not supported on SMB appliances, thus why it appears greyed out in SmartConsole.

[Exonix]

I get it now. That's probably why TAC doesn't respond to me for a long time - apparently they haven't figured out why this is happening yet... But then why are my VPN Blades gray and not activated like the same Firewall? I'll try to test RAS tomorrow, maybe it's a display bug...

[PhoneBoy]

Have you pushed a policy to the gateway that includes a VPN/Remote Access configuration?
By that I mean something outside of simply enabling IPsec VPN on the relevant gateway object.

[Exonix]

yes, i did, but looks like I forgot to add Security Gateway into RemoteAccess community. How Remote Acces Blade is aktive, but Site to Site VPN is still inactive:

[Exonix]

solution: the security gateway should be added to each Default VPN-Community: