Getting Started with Mobile Access

Recommended Deployments

Mobile Access can be deployed in a variety of ways depending on an organization's system architecture and preferences.

Simple Deployment

In the simplest Mobile Access deployment, one Mobile Access enabled Security Gateway inspects all traffic, including all Mobile Access traffic. IPS and Anti-Virus can be active on all traffic as well. The Security Gateway can be on the network perimeter.

This is the recommended deployment. It is also the least expensive and easiest to configure as it only requires one gateway machine for easy and secure remote access.

Deployment in the DMZ

When a Mobile Access enabled Security Gateway is placed in the DMZ, traffic initiated both from the Internet and from the LAN to Mobile Access is subject to firewall restrictions. By deploying Mobile Access in the DMZ, the need to enable direct access from the Internet to the LAN is avoided. Remote users initiate an SSL connection to the Mobile Access Gateway. The firewall must be configured to allow traffic from the user to the Mobile Access server, where SSL termination, IPS and Anti-Virus inspection, authentication, and authorization take place. Requests are then forwarded to the internal servers via the firewall.

Cluster Deployment

If you have large numbers of concurrent remote access users and continuous, uninterrupted remote access is crucial to your organization, you may choose to have Mobile Access active on a cluster. A cluster can be deployed in any of the deployments described above.

Each cluster member has three interfaces: one data interface leading to the organization, a second interface leading to the internet, and a third for synchronization. Each interface is on a different subnet.

In a simple deployment with the Mobile Access cluster in the DMZ, two interfaces suffice; a data interface leading to the organization and the internet, and a second interface for synchronization.

Deployments with VSX

You can enable the Mobile Access Software Blade on VSX Virtual Systems.

This feature is supported in R77.10 and higher.

You can use a VSX deployment to support different Mobile Access scenarios. Each Virtual System can have a Mobile Access portal with different applications, access policies, authentication requirements, and mobile clients.

For example, in the picture below, a VSX Gateway has four Virtual Systems with Mobile Access enabled. Each Virtual System has Mobile Access configured with different settings to meet the company's needs for different users.

This table shows an example of different settings that you can have on each Virtual System.

SmartDashboard Toolbar

You can use the SmartDashboard toolbar to do these actions:

Getting Started with Mobile Access

The steps required in SmartDashboard before working with Mobile Access are:

1. Enable the Mobile Access blade on a Security Gateway or Security Gateway cluster: In the General Properties page of a Security Gateway, in the Network Security tab, select Mobile Access.'

   Note - The Mobile Access blade can only be enabled on Security Gateways running on the SecurePlatform and Gaia operating systems.

2. When you enable the Mobile Access blade:
   • You are automatically given a 30 day trial license for 10 users.
   • The Mobile Access Wizard opens. Follow the instructions to configure remote access to your network.
3. Configure your firewall access rules to permit Mobile Access traffic. The actual rules needed depend on your configuration. Implied rules are automatically added to the Rule Base to allow:
   • HTTPS (TCP/443) traffic.
   • HTTP (TCP/80). Requests are redirected to HTTP (TCP/443).
   • The DNS servers and WINS servers configured on the gateway.

   The Security Gateway might also need access to: LDAP, RADIUS, or ACE servers for authentication, and an NTP server for clock synchronization.

4. Configure the authentication scheme that the Mobile Access gateway will accept from remote users. Do this in Gateway Properties > Mobile Access > Authentication.

Sample Mobile Access Workflow

This is a high-level workflow to configure remote access to the internal applications and resources.

1. Use SmartDashboard to enable the Mobile Access Software Blade on the Security Gateway.
2. Follow the steps in the Mobile Access Configuration wizard to configure these settings:
   • Select mobile device access clients
   • Define the Mobile Access portal
   • Define the web applications, for example Outlook Web App
   • Connect to the AD server for user information
3. For VPN clients, add Firewall rules to allow the mobile device connections.
4. Optional: Distribute client certificates to authenticate the mobile users.

   For R76 and higher, use the Certificate Creation and Distribution Wizard.

5. Users download the Check Point Mobile app.
6. Users open the Check Point Mobile app and enter the Mobile Access Site Name and necessary authentication, such as user name and password.

Mobile Access Wizard

The Mobile Access Wizard runs when you enable the Mobile Access blade on a gateway. It lets you quickly allow selected remote users access to internal web or mail applications, through a web browser, mobile device, or remote access client.

See Check Point Remote Access Solutions to understand more about the remote access clients mentioned in the wizard. Many of the settings in the wizard are also in Gateway Properties > Mobile Access.

Going through the wizard:

1. Mobile Access Methods - Select from where users can access the Mobile Access applications:
   • Web - Through a browser on any computer. SSL Network Extender can be downloaded by users when necessary to access native applications.
   • Mobile Devices - Through an iOS or Android Mobile device. Devices must have a Check Point app installed.
     • Capsule Workspace - Use Check Point Capsule Workspace - An app that creates a secure container on the mobile device to give users access to internal websites, file shares, and Exchange servers.
     • Capsule Connect/VPN - A full L3 tunnel app that gives users network access to all mobile applications.
   • Desktops/Laptops - Through a remote access client installed on a desktop computer. Select the clients to allow:
     • Endpoint Security VPN - Endpoint Security VPN for Windows or Mac. Includes desktop firewall and security compliance verification.
     • Mobile - Check Point Mobile for Windows. Includes security compliance verification.
     • SecuRemote - SecuRemote for Windows.
2. Web Portal - Enter the primary URL for the Mobile Access portal. The default is the https://<IP address of the gateway>/sslvpn. You can use the same IP address for all portals on the gateway with a variation in the path. You can import a p12 certificate for the portal to use for SSL negotiation. All portals on the same IP address use the same certificate.
3. Applications - Select the applications that will be available to web or mobile device users:
   • Web Applications - Select the web applications to show on the Mobile Access portal.
     • Demo web application (world clock) - Select while testing Mobile Access, to have a web application show as it will when you are in production.
     • Custom web application - Enter the URL of the web application that you want users to be able to open when they connect with Mobile Access. For example, you can set the home page of your intranet site.
   • Mail/Calendar/Contacts - Enter the Exchange server that mobile devices work with and select which applications mobile device users can access.
     • Capsule Workspace Mail
     • ActiveSync Applications
     • Outlook Web App
4. Active Directory Integration - Select the AD domain, enter your credentials and test connectivity. If you do not use AD, select I don't want to use active directory now.
5. Users -Select users and groups from Active Directory or internal users. You can also create a test user that will get access to the configured applications.
6. What's Next? - This window helps you understand steps that are required to complete the automatic configuration done by the Mobile Access wizard. Depending on the selections you made, you might see these steps:
   • Edit the Firewall policy and add a rule for Remote Access Community - To work with Desktop Remote Access Clients or Capsule Connect clients, the Mobile Access Wizard automatically includes this gateway in the Remote Access VPN community. Remote Access Clients get access rules from the Firewall Rule Base. See Preparing for Desktop Clients.
   • Install policy on this security gateway - When you install policy, the changes made by the Mobile Access Wizard become active.
   • Log in to the Web portal (usually https://<ip address>/sslvpn) - This is the web portal that you configured. Log in to see and use it. See Setting up the Mobile Access Portal.
     Each Mobile Access-enabled Security Gateway leads to its own Mobile Access user portal. Remote users log in to the portal using an authentication scheme configured for that Security Gateway.

     Remote users access the portal from a Web browser with https://<Gateway_IP>/sslvpn, where <Gateway_IP> is one of these:

     • FQDN that resolves to the IP address of the Security Gateway
     • IP address of the Security Gateway

     Remote users that use HTTP are automatically redirected to the portal using HTTPS.

     Note - If Hostname Translation is the method for link translation, FQDN is required.

     Set up the URL for the first time in the Mobile Access First Time Wizard.

     You can change the URL of the portal and the look and feel:

     • To change the IP address used for the user portal: From the properties of the Gateway object, select Mobile Access > Portal Settings.
     • To configure the look and feel of the portal in the Portal Customization page: Go to Mobile Access tab > Portal Settings > Portal Customization.
   • Install Check Point Capsule Workspace App and Desktop VPN client - Install an App or VPN client to start using it. See Preparing for Mobile Devices and Preparing for Desktop Clients.
   • Easily deploy client certificates to your users with the new client certificates tool - If you use authentication with client certificates, see Managing Client Certificates.

Setting up the Mobile Access Portal

Each Mobile Access-enabled Security Gateway leads to its own Mobile Access user portal. Remote users log in to the portal using an authentication scheme configured for that Security Gateway.

Remote users access the portal from a Web browser with https://<Gateway_IP>/sslvpn, where <Gateway_IP> is one of these:

• FQDN that resolves to the IP address of the Security Gateway
• IP address of the Security Gateway

Remote users that use HTTP are automatically redirected to the portal using HTTPS.

Set up the URL for the first time in the Mobile Access First Time Wizard.

You can change the URL of the portal and the look and feel:

• To change the IP address used for the user portal: From the properties of the Gateway object, select Mobile Access > Portal Settings.
• To configure the look and feel of the portal in the Portal Customization page: Go to Mobile Access tab > Portal Settings > Portal Customization.

Configuring Mobile Access Policy

The Mobile Access policy applies to the Mobile Access portal and Capsule Workspace. It does not apply to Desktop clients or Capsule Connect.

Users can access applications remotely as defined by the policy rules. Configure Mobile Access policy in the Policy page of the Mobile Access tab. Create rules that include:

• Users and User Groups.
• Applications that the users can access.
• The gateways that the rule applies to.

Users and applications have multiple properties that you can choose to configure. However, you can add objects to a rule quickly and configure more detailed properties at a different time.

Settings related to what users can access from mobile devices are also defined in the Mobile Settings Profile: Mobile Access tab > Mobile Settings.

To create rules in the Mobile Access Rule Base:

1. In the Policy page of the Mobile Access tab, click one of the add rule buttons.
2. In the Users column, click the + sign, or right-click and select Add Users.
3. In the User Viewer that opens, you can:
   • Select a user directory, either internal or an Active Directory domain.
   • Search for and select individual users, groups, or branches.
4. In the Applications column, click the + sign, or right-click and select Add Applications.
5. In the Application Viewer that opens, you can:
   • Select an application from the list.
   • Click New to define a new application.
6. If you create a New application:
   1. Select the type of application.
   2. In the window that opens enter a Display Name that end-users will see, for example, Corporate Intranet.
   3. Enter the URL or path to access the application according to the example shown.
7. In the Install On column, click the + sign, or right-click and select Add Objects and select the gateways that the rule applies to.
8. Install the Policy (Policy > Install).

Preparing for Capsule Workspace

To enable devices to connect to the gateway with Capsule Workspace:

1. Enable and configure Mobile Access on the gateway.
2. In the Mobile Access wizard or in Gateway Properties > Mobile Access, select Mobile Devices and Capsule Workspace.
3. In Gateway Properties > Mobile Access > Authentication, select how users authenticate to the mobile device.

   If you use Certificates, in the Mobile Access tab, select Client Certificates to create and distribute certificates for authentication between the devices and the gateway.

4. Optional: Configure ESOD Bypass for Mobile Apps.
5. Make sure you have rules in the Firewall Rule Base that allow traffic from mobile devices. For example, access to Exchange and application servers from the gateway.
6. Download a Capsule Workspace App from the App Store or Google Play to mobile devices.
7. Give users instructions to connect including the:
   • Site Name
   • Registration key (if you use certificate authentication)

   If you use certificate authentication, we recommend that you include this information in the client certificate distribution email.

Preparing for Capsule Connect

To enable devices to connect to the gateway with Capsule Connect:

1. Enable and configure Mobile Access on the gateway.
2. In the Mobile Access wizard or in Gateway Properties > Mobile Access, select Mobile Devices and Secure VPN Client.
3. In Gateway Properties > VPN Clients > Authentication, select how users authenticate to the mobile device.

   If you use Certificates, in the Mobile Access tab, select Client Certificates to create and distribute certificates for authentication between the devices and the gateway.

4. Make sure you have rules in the Firewall Rule Base that allow traffic from mobile devices. For example:
   • Remote Access VPN Community access.
   • Access to Exchange and application servers from the gateway.
5. Download a Check Point App from the AppStore or Google Play Market to mobile devices.
6. Give users instructions to connect including the:
   • Site Name
   • Registration key (if you use certificate authentication)

   If you use certificate authentication, we recommend that you include this information in the client certificate distribution email.

Preparing for Desktop Clients

• See Check Point Remote Access Solutions to understand which desktop clients are available, which Software Blades and licenses they require, and where to get the client and its documentation.
• Read the documentation for your client and make sure the required configuration is done. Most required gateway settings are configured automatically when you select Desktop Clients in the Mobile Access Wizard or in Gateway Properties > VPN Clients.
• Configure an authentication method in Gateway Properties > VPN Clients > Authentication. Make sure users have the required information to connect.
• In SmartDashboard a Remote Access Community object represents the users and gateways that can connect to each other through IPsec VPN tunnels. This object is in the Firewall Objects Tree > VPN Communities.

  

  If you use a desktop VPN client, use the Remote Access Community object in the Firewall Rule Base to remote access traffic. Add it in the VPN column. For example: