Checkpoint RAS solutions

[nickliako]

The more I struggle to clarify a bit Checkpoint's Remote Access Solutions as well as their licensing options,
the more I get confused.

What I thought so far with regard to SNX is that it uses SSLVPN and since we are allocated an OM IP address, it consumes from the MOB license (concurrent connections)
However as the below pic illustrates (taken from sk67820) it seems that there are 2 snx versions ?!?!

Also according to the same SK the Endpoint Security VPN software demands
The IPsec VPN Software Blade on the Security Gateway
An Endpoint Container license
An Endpoint VPN Software Blade license on the Security Management Server.

My question is the following:
I have a trial version of a Checkpoint vm having IPSEC VPN, MOB software blades
On another PC I have enabled and configured Endpoint Security VPN client to connect to the aforementioned gateway.
The connection succeeds.
Why is that since I don't have any of the aforementioned licenses enabled ? And from which license I consume ?

[Jejerod]

My question is the following:
I have a trial version of a Checkpoint vm having IPSEC VPN, MOB software blades
On another PC I have enabled and configured Endpoint Security VPN client to connect to the aforementioned gateway.
The connection succeeds.
Why is that since I don't have any of the aforementioned licenses enabled ? And from which license I consume ?

You can connect to a MOB gateway with Endpoint Connect. It should be counted as Mobile VPN (Concurrent Connection License). It won't get a desktop policy etc. of course.

The remote access client is basically always the same (same msi, different options), but features are different. You can tell that Endpoint Connect does more on installation as it requires reboot on install and uninstall, while Mobile VPN does not. Both installations can, however, connect to Mobile Access Gateways. Not sure if Mobile VPN can connect to Endpoint Connect GWs, I don't think so.

Basically:
- SecureClient: Does not require a special license (you can't have a license without ipsec VPN with checkpoint), does not support OM or any special features
- Mobile VPN (aka Capsule Connect aka Capsule VPN on mobile devices like smartphones): Connects to MOB GW, licensed per concurrent connection, also, SSLVPN (Portal/SNX) use the same license.
- Endpoint Connect: Connects to Endpoint GW (MOB GW also works), licensed per installation, supports extra features like desktop policy etc.

At least, that is how I understand RAS solutions.

[mcnallym]

Standlone IPSEC VPN Client

Endpoint Security VPN ( SecureClient ) - Requires IPSEC VPN Blade, also requires Endpoint VPN License - Provides Office Mode and Desktop Policy from VPN Gateway configured under Desktop Policy in SmartConsole
Mobile for Windows - Terminates on the MOB using MOB licenses. OM but no Firewall - confusing called Mobile but is for Windows Desktops not Mobile Devices.
SecuRemote - Requires IPSEC VPN Blade, as previous no OM, No Protection

All install from the same MSI

These cannot be installed if using the Endpoint Suite as they are Standalone VPN Clients

Endpoint VPN

You can also deploy a VPN Blade as part of the Endpoint Suite which uses Same License as Endpoint Security VPN but connects to Endpoint Security Server. Protection is set via the Endpoint Server not the Desktop Policy.


SSL Network Extender - Terminates on the MOB if present, otherwise terminates on the IPSEC VPN Blade. Licensed depending upon how terminated.


For iOS/Android

Capsule Connect/VPN - Uses MOB license and terminates on Mobile Access Blade

[Bob_Zimmerman]

You can connect to a MOB gateway with Endpoint Connect. It should be counted as Mobile VPN (Concurrent Connection License). It won't get a desktop policy etc. of course.

The remote access client is basically always the same (same msi, different options), but features are different. You can tell that Endpoint Connect does more on installation as it requires reboot on install and uninstall, while Mobile VPN does not. Both installations can, however, connect to Mobile Access Gateways. Not sure if Mobile VPN can connect to Endpoint Connect GWs, I don't think so.

Basically:
- SecureClient: Does not require a special license (you can't have a license without ipsec VPN with checkpoint), does not support OM or any special features
- Mobile VPN (aka Capsule Connect aka Capsule VPN on mobile devices like smartphones): Connects to MOB GW, licensed per concurrent connection, also, SSLVPN (Portal/SNX) use the same license.
- Endpoint Connect: Connects to Endpoint GW (MOB GW also works), licensed per installation, supports extra features like desktop policy etc.

At least, that is how I understand RAS solutions.

SecureClient definitely supports Office Mode. You're thinking of SecuRemote, which is the same software installed in a different mode. I don't think either is supported anymore (i.e., you can't call tech support for help), but both should still work. As a side note, I got several calls in the TAC where someone had installed SecuRemote to hundreds of workstations, then bought the SecureClient license and wanted to enable the features. Once installed as SecuRemote, the client software would never even ask for an Office Mode IP or any of the other features. You had to uninstall SecuRemote, reboot, reinstall it as SecureClient, and reboot again. Meanwhile, if installed as SecureClient, it would happily work with a firewall offering only the SecuRemote feature set. That pointless artificial differentiation caused enormous headaches for support.

I thought Endpoint Connect was the $0 replacement for SecuRemote and that there was some other name for the Endpoint mode with desktop security policy, client verification, and so on.

[PhoneBoy]

On a trial license, you have "all of the above" in terms of VPN connectivity.
Meaning, you can use either the "Endpoint Security" options or the "Mobile Access" options (SNX or Check Point Mobile)--in addition to SecuRemote, which still exists as a "free" option.
Note that most permanent gateway licenses include 5 users of Mobile Access Blade free of charge.