R82.10 Mobile Access Administration Guide

Introduction to Mobile Access

Mobile Access

Check Point Mobile Remote Access VPN is the safe and easy solution to connect to corporate applications over the internet with your mobile device or PC. The solution provides enterprise-grade remote access with both Layer 3 VPN and SSL VPN. It gives you simple, safe, and secure connectivity to your email, calendar, contacts, and corporate applications. At the same time, it protects networks and endpoint computers from threats.

The Mobile Access Portal lets mobile and remote workers connect easily and securely to critical resources over the internet.

Check Point Mobile Apps enables secure encrypted communication from unmanaged smartphones and tablets to your corporate resources.

Mobile Access Applications

Mobile Access provides the remote user with access to various corporate applications, including:

• Web applications: A set of URLs accessed through a browser, such as inventory management or HR management.
• File shares: Collection of files made available across the network through a protocol, enabling actions like opening, reading, writing, and deleting files.
• Citrix services: Mobile Access supports Citrix client connectivity to internal XenApp servers.
• Web mail services:
  • Built-in web mail: Provides access to corporate mail servers via the browser, using IMAP and SMTP protocols.
  • Other services like Outlook Web Access (OWA) and IBM Lotus Domino Web Access (iNotes).
• Mobile device support includes access to Web applications, email, calendar, contacts, and multi-factor authentication.
• Mobile Access supports IPv6 for connections to the Mobile Access Portal and Capsule Workspace.

Notes:

• SSL Network Extender is not supported with IPv6.
• IPv6 is supported for inbound connections to the Security Gateway only.
• SSL Network Extender support for macOS as part of Capsule Workspace Access.
• Mobile Access supports all native applications through SSL Network Extender, ensuring traffic is encrypted.

Remote users initiate a standard HTTPS request to the Mobile Access Security Gateway. The Security Gateway authenticates users based on one or more configured authentication methods. Users have access to applications based on the Mobile Access policy.

For more information about applications, see Mobile Access Applications.

For native applications, see the SSL Network Extender (SNX) Administration Guide.

Mobile Access Management

• The Security Management Server manages all Check Point Security Gateways, including Mobile Access Security Gateways.
• Configure Mobile Access from the Mobile Access tab of SmartDashboard and in the Access Control Rule Base.
• Mobile Access users and related network objects are shown in SmartConsole.
• See Mobile Access logs in SmartLog from the SmartConsole Logs & Events view.
• Mobile Access supports SNMP. For more details, refer to the R82.10 Gaia Administration Guide > Chapter System Management > Section SNMP.

Commonly Used Concepts

Authentication

Remote users accessing the Mobile Access Portal must be authenticated. Multiple login options and multi-factor authentication are supported. See User Authentication and Session Management in Mobile Access.

Authorization

Authorization controls how remote users access internal applications on the corporate LAN. Without authorization, access to services provided by the Mobile Access Security Gateway is not granted.

Endpoint Compliance Scanner

The Check Point Endpoint Security on Demand scanner checks if the endpoint machine complies with the compliance policy, ensuring up-to-date Anti-Virus signatures and active Firewall.

Secure Workspace

Check Point's proprietary virtual desktop protects data during user sessions, ensuring cache wiping after sessions end. It encrypts files created during access sessions and cleans the cache afterward.

Protection Levels

Protection Levels are requirements users must meet before accessing resources, with three pre-defined levels: Permissive, Normal, and Restrictive.

Session

After authentication, remote users are assigned a Mobile Access session, which lasts until the user logs out or the connection times out.

SSL Network Extender

The SSL Network Extender client allows access to native applications through Mobile Access, downloading automatically from the Mobile Access Portal.

Server Side Security Highlights

Mobile Access Gateways integrate with the same security features as other Security Gateways, including:

• IPS: Protects organizations from known and unknown network attacks.
• Anti-Virus: Prevents infections by applying settings on the Security Gateway.
• Granular authorization policy: Limits user access based on various security requirements.
• Web Application support over HTTPS: Encrypts traffic to web applications.
• Encryption: Uses 3DES or RC4 algorithms for secure traffic.

Client Side Security Highlights

Important client-side security features include:

• Endpoint Compliance: Prevents threats from non-compliant endpoint clients.
• Secure Workspace: Protects session-specific data and prevents data leakage.
• Browser caching control: Configures caching settings for browsers accessing Mobile Access Applications.
• Cookie capture: Mobile Access captures cookies and manages them for internal server requests.
• Supports multi-factor authentication: Allows options like SecurID tokens and client certificates.