Check Point Endpoint Security Vpn
Checkpoint Endpoint Security Vpn Client Mac
Checkpoint Endpoint Security Vpn Client Linux
Checkpoint Endpoint Security Vpn Client Download E80.83
Checkpoint Endpoint Security Vpn Client

In This Section:

This section includes procedures and explanations for configuring Remote Access VPN. For configuration specific to Endpoint Security VPN, Check Point Mobile for Windows, and SecuRemote, see the Remote Access Clients Administration Guide. Remote Access VPN Workflow. This section shows the Remote Access VPN Workflow. Encryption of all transmitted data can be done within in a single session between the client and server using TLS. This is the widely used client to server standard used to secure web traffic to banks, hospitals, web search, etc. Endpoint Security Introduction. Endpoint Security Architecture. Endpoint Security Licenses. Using SmartEndpoint. Users and Computers. Deploying Endpoint Security Clients. Defining Endpoint Security Policies. External Endpoint Policy Servers. Management High Availability. Active Directory Authentication. Backup and Restore. Full Disk Encryption. Check Point endpoint security solutions provide data security, network security, advanced threat prevention, forensics and remote access VPN for complete endpoint protection. Check Point Anti-Malware and Application Control further help to efficiently detect malware with a single scan and make sure only approved software programs are running on.

Client-Security Gateway Authentication Schemes

Authentication is a key factor in establishing a secure communication channel among Security Gateways and remote clients. Various authentication methods are available, for example:

Digital certificates
Pre-shared secrets
Other authentication methods

On R80.10 and higher Mobile Access and IPsec VPN gateways, you can configure multiple login options. The options can be different for each gateway and each Software Blade. Users select one of the available options to log in with a supported client.

See the documentation for each client to learn which authentication methods are supported.

Digital User Certificates

Digital Certificates are the most recommended and manageable method for authentication. Both parties present certificates as a means of proving their identity. Both parties verify that the peer's certificate is valid (i.e. that it was signed by a known and trusted CA, and that the certificate has not expired or been revoked).

Digital certificates are issued either by Check Point's Internal Certificate Authority or third-party PKI solutions. Check Point's ICA is tightly integrated with VPN and is the easiest way to configure a Remote Access VPN. The ICA can issue certificates both to Security Gateways (automatically) and to remote users (generated or initiated).

Generate digital certificates easily in SmartConsole > Security Policies > Access Tools > Client Certificates.

The administrator can also initiate a certificate generation on the ICA management tool. It is also possible to use third-party Certificate Authorities to create certificates for authentication between Security Gateways and remote users. The supported certificate formats are PKCS#12, CAPI, and Entrust.

Users can also be given a hardware token for storing certificates. This option offers the advantage of higher level of security, since the private key resides only on the hardware token.

As part of the certificate validation process during the IKE negotiation, both the client and the Security Gateway check the peer's certificate against the Certificate Revocation List (CRL) published by the CA which issued the certificate. If the client is unable to retrieve a CRL, the Security Gateway retrieves the CRL on the client's behalf and transfers the CRL to the client during the IKE negotiation (the CRL is digitally signed by the CA for security).

Pre-Shared Secret

This authentication method has the advantage of simplicity, but it is less secure than certificates.

Both parties agree upon a password before establishing the VPN. The password is exchanged 'out-of-band', and reused multiple times. During the authentication process, both the client and Security Gateway verify that the other party knows the agreed-upon password.

Other Authentication Methods

These user authentication methods are supported for remote access.

Security Gateway Password - Users enter their password that are on the Security Gateway.
DynamicIDOne Time Password - Users enter the number shown in an SMS message to a specified cellphone number or by email.
OS Password - Users enter their Operating System password.
SecurID One Time Password - Users enter the number shown on a Security Dynamics SecurID card.
SoftID (a software version of RSA's SecurID) and various other One Time Password cards and USB tokens are also supported.
RADIUS - Users enter the correct response, as defined by the RADIUS server.
TACACS - Users enter the correct response, as defined by the TACACS or TACACS+ server.
SAA - SAA is an OPSEC API extension to Remote Access Clients that enables third party authentication methods, such as biometrics, to be used with Endpoint Security VPN, Check Point Mobile for Windows, and SecuRemote.

Multiple Login Options for R80.xx Gateways

On R80.10 and higher Mobile Access and IPsec VPN gateways, you can configure multiple login options. The options can be different for each gateway and each supported Software Blade, and for some client types. Users select one of the available options to log in with a supported client.

By default, all clients connect with the pre-R80.xx method. When you create new login options, newer clients can see them in addition to the pre-R80.xx option, but older clients cannot.

To see which clients support the new multiple login options, see sk111583.

Each configured login option is a global object that can be used with multiple gateways and the Mobile Access and IPsec VPN Software Blades.

Compatibility with Older Clients

By default, older clients connect with a single authentication method, based on settings available on pre-R80 gateways.

You can block older clients from connecting. After you do this, only clients that support multiple login options can connect to the gateway.

By default, Allow old clients to connect is selected in VPN Clients > Authentication. If you clear the option, older clients are blocked.

You can choose if newer clients that support multiple login options can connect with the authentication settings defined for older clients.

Configuring the Authentication Method for Newer Clients

To block newer clients from using the authentication method defined for older clients:

In the Gateway Properties, select VPN Clients > Authentication.
In the Compatibility with Older Clients section, click Settings.
The Single Authentication Clients Settings window opens.
Clear Allow newer client that support Multiple Login Options to use this authentication method.
Click OK.
Install policy.

To let newer clients connect to the gateway with the authentication settings defined for older clients:

Select Allow newer client that support Multiple Login options to use this authentication method.

Configuring Authentication Settings for Older Clients

To let older clients connect to the R80.10 gateway:

In the Gateway Properties, select VPN Clients > Authentication.
Select Allow older clients to connect to this gateway.
If this is not selected, older clients cannot connect to the gateway.

To change the authentication method for older clients:

In the Gateway P

Checkpoint Endpoint Security Vpn Client