How to Restrict Non-Compliant Clients

[arifkm786]

All,
My current Env:
Integrity SecureClient 6.5;
Integrity Adavnced Server 6.5;
CheckPoint NGX R62.

When a vpn client becomes non-complaint , which setting actually decides that the end user would be "Restricted" from accessing the internal resources.

The possible settings which would do these i think are.

Setting on the Integrity Server.
a) In the Enforcement Rule Action "Restrict clients that dont comply"


or

Setting in local.scv

b) block_connections_on_unverified(true) in the SCVGlobalParams section in local.scv file


or

c) Global Properties--->RemoteAccess-->SecureConfigurationVerification(SCV)--->Block Client Connection on Verification failure.


or which of these override each other or in what order.....

When i turn on setting (a) and turn off setting (c) , the integrity client says Integrity Policy is Restricted but iam still able to access the internal resources.

I would really appreciate if someone can shed light on this please.


Thanks

[aussie_in]

Hi,

I am runing Integrity sever 6.0.0.657 and in that (a) option works fine.

Aussie

[arifkm786]

Hello Aussie, Thanx for your reply.

For me enabling option(a) on Integrity Server Enforcement Rule doesnt block any connections unless i enable option(c) on my Firewall Gateway..


Enabling option(a) , my integrity client says "Active Policy is Restricted" and Secure Client says "configuration unverified" but iam still able to access the internal resources..

Can you please confirm if thats the case in your case...

To me this is still not clear and any help from the communtity experts would be well appreciated.


Thnx

[arifkm786]

Hi, This works now ,
After setting option a) , I wasnot setting the "Restriction Firewall Rules" that block the connection on scv failure.

Thnx

[amjadali88]

Hi Everyone:

I am using checkpoint Endpoint Security Version 7.2

The issue we have currently is that the User( VPN/ Local LAN) will get the warning Alert and after 1~2 minutes he will be blocked . We want to enforce the policy in such a way that as soon as the user is non-compliant then he will be blocked immediately without any warning.


Summary:

User is non-compliant and when he connect to our network then he will be blocked within 1 seconds. ( We don't want the Policy Server to wait for Heart beat and Client Settings).

Is it a doable option with this product?

Thanks

[chillyjim]

No its not, you must wait at least one HB.

Please recheck your version, there is no 7.2 of CPES-SA.