Mobile Access for Smartphones and Tablets

1. In SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., select Security Policies > Access Control > Access Tools > Client Certificates.

2. In the Client Certificates pane, click New.

   The Certificate Creation and Distribution wizard opens.

3. In the Certificate Distribution page, select how to distribute the enrollment keys to users. You can select one or both options.

   1. Send an email containing the enrollment keys using the selected email template -Each user gets an email, based on the template you choose, that contains an enrollment key.

      • Template - Select the email template that is used.

      • Site - Select the Security Gateway, to which users connect.

      • Mail Server - Select the mail server that sends the emails.

      You can click Edit to view and change its details.

   2. Generate a file that contains all of the enrollment keys - Generate a file for your records that contains a list of all users and their enrollment keys.

4. Optional: To change the expiration date of the enrollment key, edit the number of days in Users must enroll within x days.

5. Optional: Add a comment that will show next to the certificate in the certificate list on the Client Certificates page.

6. Click Next.

   The Users page opens.

7. Click Add to add the users or groups that require certificates.

   • Type text in the search field to search for a user or group.

   • Select a type of group to narrow your search.

8. When all included users or groups show in the list, click Generate to create the certificates and send the emails.

9. If more than 10 certificates are being generated, click Yes to confirm that you want to continue.

   A progress window shows. If errors occur, an error report opens.

10. Click Finish.

11. Click Save.

12. In SmartConsole, install the Policy.

1. Select the certificate or certificates from the Client Certificate list.

2. Click Revoke.

3. Click OK.

After you revoke a certificate, it does not show in the Client Certificate list.

1. In SmartConsole, select Security Policies > Access Control > Access Tools > Client Certificates.

2. To create a new template: In the Email Templates for Certificate Distribution pane, select New.

   To edit a template: In the Email Templates for Certificate Distribution pane, double-click a template.

   The Email Template opens.

3. Enter a Name for the template.

4. Optional: Enter a Comment. Comments show in the Mail Template list on the Client Certificates page.

5. Optional: Click Languages to change the language of the email.

6. Enter a Subject for the email. Click Insert Field to add a predefined field, such as a Username.

7. In the message body add and format text. Click Insert Field to add a predefined field, such as Username, Registration Key, or Expiration Date.

8. Click inside the E-mail Template body.

9. Click Insert Link and select the type of link to add (link or QR code).

   • Site and Certificate Creation

     For users who already have a Check Point app installed.

     When users scan the QR code or go to the link, it creates the site and registers the certificate.

     Select the client type that will connect to the site- Select one client type that users will have installed:

     • Capsule Workspace - An app that creates a secure container on the mobile device to give users access to internal websites, file shares, and Exchange servers.

     • Capsule Connect/VPN - A full Layer 3 tunnel app that gives users network access to all mobile applications.

   • Download Application

     Direct users to download a Check Point App for their mobile devices.

     Select the client device operating system:

     • iOS

     • Android

     Select the client type that will connect to the site- Select one client type that users will have installed:

     • Capsule Workspace - An app that creates a secure container on the mobile device to give users access to internal websites, file shares, and Exchange servers.

     • Capsule Connect/VPN - A full Layer 3 tunnel app that gives users network access to all mobile applications.

   • Custom URL

     Lets you configure your own URL.

   For each link type, you can select which elements are added to the mail template

   • Link URL - Enter the full link address.

   • QR Code - When enabled, users scan the code with their mobile devices.

   • HTML Link - When enabled, users tap the link on their mobile devices.

     You can select both QR Code and HTML Link to include both in the email.

   • Display Text - Enter the text for the link title.

10. Click OK.

11. Optional: Click Preview in Browser to see a preview of how the email will look.

12. Click OK.

13. Publish the changes.

1. Select a template from the template list in the Client Certificates page.

2. Click Clone.

3. A new copy of the selected template opens for you to edit.

1. Run the applicable command on the Security Gateway in the Expert mode.

   Syntax:

   cvpnd_settings <Path to Conf File> {set | listAdd | listRemove} <Name> <Value>

   • To enable or disable Remote Wipe:

     cvpnd_settings $CVPNDIR/conf/cvpnd.C set RemoteWipeEnabled {true | false}

     Remote Wipe is enabled by default.

   • To enable or disable Remote Wipe by Push Notification (wipe is done if client gets notification):

     cvpnd_settings $CVPNDIR/conf/cvpnd.C set RemoteWipePushEnabled {true | false}

     The Remote Wipe Push Notifications feature is enabled by default. For supported clients, see sk95587.

   • To set supported devices for Remote Wipe Push Notifications, based on operating system:

     cvpnd_settings $CVPNDIR/conf/cvpnd.C listAdd RemoteWipePushSupportedClientOS {iOS | Android}

2. Restart the CVPN service to apply the changes:

   cvpnrestart

To see that your changes are applied, open the $CVPNDIR/conf/cvpnd.C file in Read-Only mode.

1. Make sure that the $CVPNDIR/conf/cvpnd.C file is configured for Remote Wipe and, if you want, for Push Notifications.

   If you change the file, run: [Expert@HostName:0]# cvpnrestart

2. Revoke the client certificate:

   1. Open Mobile Access tab > Client Certificates.

   2. Select certificates.

   3. Click Revoke.

   4. Click OK.

1. Open SmartConsole.

2. From the left navigation panel, click Logs & Events > Logs.

3. Query for:

   "Remote Wipe" AND blade:"Mobile Access" action:"Failed Log In"

   You can filter these results for user DN, device ID, or certificate serial number.

1. In SmartConsole, from the left taskbar, click Manage & Settings.

2. Click Blades.

3. In the Mobile Access section, click the Capsule Workspace Settings button.

   The Capsule Workspace Settings menu opens.

4. Open the Profiles tab.

5. Do one of these:

   • To create a new Mobile Profile, right click inside the table > click New.

   • To edit an existing Mobile Profile, right click on the table row that contains the profile > click Edit...

   The Mobile Profile window opens.

6. Change settings. See the Capsule Workspace Settings in the Mobile Profile section below.

7. Click OK.

8. Install policy.

1. In the Security tab, configure Access Settings:

   • Session timeout - After users authenticate with the authentication method configured in Gateways & Servers > Security Gateway object > Mobile Access > Authentication, configure how long they stay authenticated to the Security Gateway.

   • Activate Passcode lock - Select to protect the Business Secure Container area of the mobile device with a passcode.

     • Passcode profile - Select a passcode profile to use. The profile includes the passcode complexity, length, expiration, and number of failed attempts allowed.

     • Allow storing user credentials on the device for single-sign on - If username and password authentication is used, store the authentication credentials on the device. Then users are only prompted for their passcode not also for their username and password.

   • Report jail-broken devices - Create a log if a jail-broken device connects to the Security Gateway.

     • Block access from jail-broken devices - Block devices that are jail-broken from connecting to the Security Gateway.

   • Block third party keyboard - Block keyboards that are not the native keyboard for the operating system of the endpoint device.

   • Hide 'connect anyway' on SSL trust screen - If the endpoint device does not trust the certificate of the Security Gateway, users do not have the option to connect.

2. In the Applications tab, select which application features are available on devices:

   • Mail

     • Allow printing mail - allows users of the endpoint device to print email.

     • Max attachment size (MB) - select the maximum attachment size to allow.

   • Offline Content - configure what data is saved and for how long when the Check Point App cannot reach the Security Gateway.

     • Mail from the last x days - Select the length of time from which emails are saved.

     • Calendar from the last x months and the following x months - Select which parts of the calendar are saved: the length of time in the past and length of time in the future.

     • Synchronize contacts - Synchronize contacts from the organization's mail server to the endpoint device.

   • Push Notifications - allow push notifications on devices. See the Push Notifications section below for details. To use this, push notifications must be enabled for Capsule Workspace on the Security Gateway that users connect to.

   • Calendar - select Allow business calendar to sync to the device's native calendar if you want to sync both calendars on the device. Events from Capsule Workspace will show in the device's calendar, outside of Capsule Workspace.

   • Contacts - select which additional contacts to show in Capsule Workspace on the device:

     • Global Address List - contacts from the end user's corporate Microsoft Outlook application.

     • Mobile Device's contact list - contacts from the mobile device's contact list.

   • Web Applications - Save local web cache configure what data is saved and for how long when the Check Point App cannot reach the Security Gateway. By default, the endpoint device is allowed to save data in its local cache.

   • Check Point Capsule Documents - select the Capsule Docs information that is stored in Capsule Workspace.

     • Allow caching Check Point Capsule Docs credentials - The credentials are required to open Capsule Docs protected documents are cached on the device. If they are not cached, users must enter their credentials each time they open a document for the first time.

     • Allow caching Check Point Capsule Docs keys - The Capsule Docs keys are cached on the device. If they are cached users can open a previously opened document with no need to enter credentials.

3. In the Data Loss Prevention tab, configure settings for Outbound and Inbound traffic.

   • Outbound

     • Share protected files extensions to external apps - Select which types of protected files can "exit the boundaries" of Capsule Workspace. In Android, this setting restricts the "share" action. In iOS, this setting restricts all actions that take a file from Capsule Workspace.

     • Share unprotected files extensions to external apps - Select which types of unprotected files can "exit the boundaries" of Capsule Workspace. In Android, this setting restricts the "share" action. In iOS, this setting restricts all actions that take a file from Capsule Workspace.

     • Open the following extensions with external apps when they cannot be opened with Capsule viewer - This rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session. applies only in Android. This rule describes which types of files can "exit the boundaries" of Capsule Workspace when Capsule Workspace cannot display the file. Capsule Workspace prompts the user to pick an app in which to open the file.

     • Block Screenshot - select to block end users from taking screenshots inside of Capsule Workspace.

     • Allow copy paste to external apps - select to allow Capsule Workspace users to copy content and paste it into external apps.

     • Block forward attachments by mail - select to prevent Capsule Workspace users from forwarding email attachments outside of the organization.

     • Allow domain for forward attachments by mail - Enter a fully qualified domain name that Capsule Workspace users are allowed to forward emails. You can enter more than one FQDN separated by commas. For the entered domains this setting overrides the previous setting.

   • Inbound

     • Accept protected files with these extensions from external apps - Select which types of protected files can "enter the boundaries" of Capsule Workspace.

     • Accept unprotected files with these extensions from external apps - Select which types of unprotected files can "enter the boundaries" of Capsule Workspace. This holds only for files not protected by Capsule Docs.

     • Offer Capsule as a viewer for external protected documents - Select to configure the device to offer Capsule Workspace as a document viewer for protected documents from outside of the organization. This is similar to the behavior of Capsule Docs.

     • Allow taking photos and videos - Select to allow the device's camera to take pictures and videos and bring them into Capsule Workspace.

     • Allow Importing media From Gallery - Select to allow the user to import media from the device into Capsule Workspace.

4. In the Harmony Mobile section, configure settings for Harmony Mobile integration with the Harmony Mobile application or with Harmony App Protect.

   • Enabled application integration - Capsule Workspace enforces installation of Harmony Mobile. If Harmony Mobile does not meet the requirements of the policy, Capsule Workspace does the enforcement action.

     • Enforcement policy - Select under which conditions Capsule Workspace does the enforcement action:

       • Not enforced - Capsule Workspace does not enforce a security policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection..

       • Ensure application installed - If Harmony Mobile is not installed on the device, Capsule Workspace does the enforcement action.

       • Ensure application activated - If Harmony Mobile is not activated on the device, Capsule Workspace does the enforcement action.

       • Ensure application compliant - If Harmony Mobile finds that the device is not compliant with the security policy, Capsule Workspace does the enforcement action.

     • Enforcement action - Select what Capsule Workspace does when the device does not meet the Harmony enforcement policy:

       • Warn - Capsule Workspace warns the user that the device does not meet the policy.

       • Block - Capsule Workspace does not open.

     • Enforcement Message - Enter a free text message for Capsule Workspace to show the user when it does the enforcement action. If you do not enter an enforcement action, then Capsule Workspace users see pop-up messages with the options Continue Anyway (only if the enforcement action is Warn) and Sign Out.

   • Enable Harmony App Protect - enable the administrator to use the software development kit (SDK) to configure the behavior of Capsule Workspace. This feature requires an additional license. Enter the license in the Harmony App Protect license field. For each kind of security vulnerability that Harmony App Protect can detect, select how Harmony App Protect enforces policy for Capsule Workspace.

     List of security vulnerabilities:

     • Device Compromised

     • Malware

     • Man in the Middle Attack

     • OS Integrity Compromised

     • Suspicious App

     • Suspicious Enterprise Certificate

     List of enforcement actions:

     • Block - Capsule Workspace shows users a block page and is not usable.

     • Notify - Capsule Workspace shows users a popup window that says there is a security vulnerability.

     • Ignore - Capsule Workspace does nothing.

5. In the Client Customization tab, configure what end users see in the client

   • Appearance

     • Application light mode color: Enter a hex color.

     • Application dark mode color: Enter a hex color.

   • Allowed items - select which Exchange features are available on endpoint devices.

     • Mail

     • Messages

     • Calendar

     • Contact

     • Tasks

     • Notes (iOS only)

     • Saved Files

   • Certificates - enter a message to show to the end user when the client certificate expires. 

6. In the Advanced tab, configure custom fields for new Capsule Workspace features that do not exist in your version of SmartConsole.

   1. In the Custom Fields section, click the plus (+) icon.
      

      The New Future Compatibility Field window opens.

   2. Enter the Key for the feature.

   3. Enter the Value for the feature.

   4. Click OK.

1. In SmartConsole, from the left taskbar, click Security Policies.

2. Click Blades.

3. In the Mobile Access section, click the Capsule Workspace Settings button.

   The Capsule Workspace Settings menu opens.

4. Open the Passcodes tab.

5. Do one of these:

   • To create a new Passcode Profile, right click inside the table > click New.

   • To edit an existing Mobile Profile, right click on the table row that contains the profile > click Edit...

   The Passcode window opens.

6. Change settings. See the Passcode Profile Settings section below.

7. Click OK.

8. Install policy.

A Passcode Profile includes these settings:

• Passcode Requirements - The complexity requirements. When you configure this, remember that users usually have a small on-screen keyboard.

  • Simple Passcode (4 digits) - Users create a simple password of 4 numbers. If this is not selected, configure options for a complex passcode:

  • • Minimum passcode length - Enter the minimum number of characters.

    • Require alphanumeric characters - Show an alphanumeric keyboard and require at least one character to be a letter.

    • Minimum complex characters - Enter the number of characters that must be a special character.

• Force passcode expiration - Enter the number of days after which user's passcodes expires and must be replaced.

• Allow grace period for entering passcode - Select to let users access the Business Secure Container for a specified period of time without re- entering their passcode. Enter the quantity of time in minutes.

• Exit after a few failures in passcode verification - Select to lock users out after a specified number of failed attempts. After the failed attempts, users must re-authenticate. If the authentication method includes username and password, users must enter them. If the authentication is certificate-only, users need a new certificate.

• Enforce passcode history - When selected, users cannot use a passcode that is the same as earlier passcodes. Select the number of earlier passcodes that users cannot use.

Enable push notifications from the Mobile Access Wizard or from the Security Gateway Properties of each Security Gateway.

• From the Mobile Access Wizard:

  • If you enable Mobile Mail in the Mobile Access Wizard, push notifications are automatically enabled for the Security Gateway.

  • If you enable Mobile Mail from the Mobile Access tab, push notifications are NOT enabled.

• From the Security Gateway Properties:

  1. Open a Security Gateway object that has Mobile Access enabled.

  2. Select Mobile Access > Capsule Workspace from the tree.

  3. Select Enable Push Notifications.

  4. Click OK.

1. Install a trusted server certificate on the Mobile Access Security Gateway. See sk98203.

2. Close all SmartConsole windows connected to the Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server..

3. Connect with Database Tool (GuiDBEdit Tool) to the Management Server.

4. Search for the field main_url (Ctrl +F).

5. Press F3 to see next main_url until you find main_url that contains the value ExchangeRegistration.

6. Double-click the ExchangeRegistration main_url field and edit the value to be https:// and not http://.

7. Save the changes and close Database Tool (GuiDBEdit Tool).

8. Connect with SmartConsole to the Management Server.

9. Open the Mobile Access Security Gateway object.

10. Click OK.

11. Install policy.

1. Download the certificate to the Exchange server.

2. Double-click the certificate file, and follow the Windows certificate installation wizard steps.

3. Run the Microsoft Management Console.

4. In the window that opens, click File > Add/Remove Snap-in.

   Add or Remove Snap-ins window opens.

5. Select Certificates from the Available snap-ins, and click Add.

6. Select My user account.

7. Click Finish.

8. Select Certificates and click Add again.

9. Select Computer account.

10. Click Next.

11. Click Finish.

12. Click OK.

    The certificate is stored in Local computer and in Current user stores.

Run the $CVPNDIR/bin/PushReport command to generate a report that contains this data:

1. License - Shows if the license is valid or if you have an evaluation license.

2. Configuration - Shows if push notifications are configured and enabled in the database.

3. Connectivity - Shows if you have a connection to the Check Point Cloud and CRLs list.

4. Callback URL - Shows the configured callback URL. If it is an https URL, the utility shows that a certificate is needed.

Output Example

Check Point uses Apple and Google services to deliver push notifications to iOS and Android devices. This is consistent with industry practice and similar to other application vendors. Accordingly, Check Point assumes no liability in the event a notification is not sent or is not successfully pushed.

Information which is sent as a push notification passes through Check Point's push service and the Apple or Google push service (according to the user's device). Check Point does not keep, filter, or read any information that passes through. Check Point may review basic information to determine if a push notification reached its destination.

Check Point provides configuration options for the information sent as a push notification. The administrator can choose whether to set the subject, the sender, or the importance of any email, and can send the meeting location for meeting invitations.

Check Point will not be held liable for any loss of information that may result during the push notification process.

1. On the Security Gateway run this command with the applicable value:

   cvpnd_settings $CVPNDIR/conf/cvpnd.C set MobileAppBypassESODforApps "true"

   or

   cvpnd_settings $CVPNDIR/conf/cvpnd.C set MobileAppBypassESODforApps "false"

   where:

   • true - Bypasses ESOD for mobile apps (default).

   • false - Does not bypass ESOD.

2. Restart the Mobile Access services:

   cvpnrestart

3. If you use a cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., copy the $CVPNDIR/conf/cvpnd.C file to all cluster members and restart the services on each.

When you allow access to an ActiveSync application, users see the ActiveSync Setup item and can install the ActiveSync profile. This gives users access to their corporate email.

The next procedure is for end users to configure on their devices. For all end user configuration procedures, see Instructions for End Users.

To connect to corporate email:

1. Sign in to the Mobile Access site.

2. Tap Mail Setup.

3. Do the on-screen instructions.

To resolve issues with client devices, tell the users to send you the logs. The iPhone or iPad must have an email account set up.

The next procedure is for end users to configure on their devices. For all end user configuration procedures, see Instructions for End Users.

To configure logs:

1. Tap the i icon.

   Before login, this is on the top right. After login, this is on the bottom right.

2. Tap Report a Problem on the navigation bar.

   If you do not have an email account configured on the iPhone, a message shows that one must be configured. After this is done, you must open Check Point Mobile Access again.

   When an email account is configured, the email page opens. The logs are attached.

   Note - The email account that the iPhone uses to send the email is the default account. This might not be your organization's ActiveSync account.

   If the iPhone is not configured for a destination email address for logs, the email that opens has an empty To field. You can enter the destination address now, or set up a default destination address for Check Point Mobile logs.

Single Sign On (SSO) lets users in a session connect to the Mobile Access Security Gateway, without authenticating when the client starts. If a user cannot access the Security Gateway while SSO is enabled, disable it.

The next procedure is for end users to configure on their devices. For all end user configuration procedures, see Instructions for End Users.

To disable SSO on a client:

1. Tap Settings.

2. Scroll down to the Check Point Mobile icon and tap it.

3. In the Mobile global settings, tap the Single Sign On > Enabled switch.

When browsing from the Android app to a server with an untrusted server certificate, you are denied access and you get this message:

"Some resources on this page reside on an untrusted host."

In some cases, such as in a staging or demo environment, you can enable browsing to servers with untrusted certificates.

For Androids, idle timeout cannot be modified or enforced by the device or the Security Gateway.

The only timeout setting that applies to the device is the active session timeout. It is configured in SmartDashboard Legacy Check Point GUI client used to create and manage the security settings in versions R77.30 and lower. In versions R80.X and higher is still used to configure specific legacy settings.: Mobile Access Software Blade > Additional Settings > Session > Re-authenticate users every x minutes option. This setting indicates the maximum session length. When this period is reached, the user must log in again. For example, if re-authentication is set to 120 minutes, a user will need to log in again after 2 hours in an active session.

To resolve issues with client devices, tell the users to send you the logs.

The next procedure is for end users to configure on their devices. For all end user configuration procedures, see Instructions for End Users.

To send logs:

1. Open the Check Point application.

2. Tap About.

3. Press the Menu button on the device.

4. Tap Send Logs.

5. Select a way to send the logs.

1. Launch the Check Point Mobile app.

2. Log in to the site.

3. Press the menu button and tap Settings.

4. Enable Allow connection to untrusted servers.

1. Launch the Check Point Mobile app.

2. Log in to the site.

3. Press the menu button and tap Settings.

4. Enable Allow connection to untrusted servers.

1. Get the Check Point Mobile app from the Android Market.

2. When prompted, enter the:

   • Site Name

   • Registration key

1. Open the Check Point application.

2. Tap About.

3. Press the Menu button on the device.

4. Tap Send Logs.

5. Select a way to send the logs.

1. Launch the Check Point Mobile app.

2. Log in to the site.

3. Press the menu button and tap Settings.

4. From the Export Certificate option, tap Export. The Export Certificate window opens.

   If the Export Certificate option is disabled, contact the system administrator.

5. Select the certificate format appropriate for your mail client: P12 or PFX.

6. Select the location to save the certificate.
   The default path is /sdcard (for devices that have an SD card) or an external resource folder (for devices that do not have an SD card).

7. Tap OK to save the certificate to the selected location.

   A window opens:

   Export succeeded. Certificate password is: _______

8. You can copy the password to the clipboard.

   You need the password when you import the certificate to the third party mail app.