Updating the SecureClient Desktop Policy

[richardsj]

Is there a way that you could have SecureClient call home, so to speak, when the user is on the internal network. We have to change the desktop inbound rules but would like to update the policy without the user having to "update site" or logon. Does anyone know of a way to do this? Is there a file we could deploy through SMS or AD when they logon that changes the policy? Any help appreciated.

Thanks

John

[Dominik Zanolari]

This is one of your requirements, too.

I've spoken to CheckPoint a while ago and was told, the only way to update the Desktop Policy is to logon at the site.

At least for the configuration, you modify the userc.c with scripts, that works quite fine if it is not encrypted.

[chillyjim]

Upgrade to Integrity SecureClient when Integrity version 7 is released (next few months <crossed-fingers>).

Integrity will then handle the policies and will update as soon as it has access to the server (local, VPN, Internet)

[dsb.nepo]

Upgrade to Integrity SecureClient when Integrity version 7 is released (next few months <crossed-fingers>).

Integrity will then handle the policies and will update as soon as it has access to the server (local, VPN, Internet)

This sounds interesting, I have never worked with integrety so my question is about the license.
Witch license is needet to run this client at top of CPVP-VEE+CPVP-VPS+CPVP-VSC?

[chillyjim]

You will need a CPVP-VSI in addition to the firewall and management licenses.
Your reseller should be able to get you some good upgrade pricing on it.

[jrdld]

I haven't tried this myself, but I'd guess you could do this by logging on to the gateway from one "Master" machine, which would update the firewall policy held in

C:\Program Files\Checkpoint\SecuRemote\policy\local.dt

and possibly the topology held in

C:\Program Files\Checkpoint\SecuRemote\database\userc.C

Then you could push the file(s) to all the other machines and restart the Secureclient services. Or maybe stop the services, push the file(s), and then restart the SC services.

JR