{"id":90211,"date":"2020-07-30T01:42:13","date_gmt":"2020-07-29T23:42:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/4-ngfw-dlya-malogo-biznesa-vpn"},"modified":"2020-07-30T01:42:13","modified_gmt":"2020-07-29T23:42:13","slug":"4-ngfw-dlya-malogo-biznesa-vpn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/4-ngfw-dlya-malogo-biznesa-vpn","title":{"rendered":"4. NGFW for Small Business. VPN","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"4.
\n<\/p>\n

We continue our series of articles on NGFW for small businesses, reminding you that we are looking at the new 1500 series model range. In this part 1<\/a><\/noindex> cycle, I mentioned one of the most useful options when purchasing an SMB device \u2014 the provision of gateways with built-in Mobile Access licenses (from 100 to 200 users depending on the model). In this article, we will discuss setting up VPN for the 1500 series gateways that come with pre-installed Gaia 80.20 Embedded. Here\u2019s a brief outline:<\/p>\n

<\/p>\n

    \n
  1. VPN capabilities for SMB.<\/li>\n
  2. Setting up Remote Access for a small office.<\/li>\n
  3. Available clients for connection.<\/li>\n<\/ol>\n

    <\/a><\/noindex><\/p>\n

    1. VPN capabilities for SMB<\/h3>\n

    <\/p>\n

    To prepare today\u2019s material, the official administrator guide<\/a><\/noindex> for version R80.20.05 (current at the time of the article) was used. Accordingly, in the VPN section for Gaia 80.20 Embedded, the following is supported:<\/p>\n

    <\/p>\n

      \n
    1. Site-To-Site. Creating VPN tunnels between your offices, where users can work as if in a single 'local' network.\n

      \"4.\n<\/li>\n

    2. Remote Access. Remote connection to your office resources using user devices (PCs, mobile phones, etc.). Additionally, there is an SSL Network Extender, which allows publishing individual applications and running them via a Java Applet when connected through SSL. Note:<\/u> Do not confuse with Mobile Access Portal (support for this is not available on Gaia Embedded).
      \n<\/i>
      \n\"4.\n<\/li>\n<\/ol>\n

      <\/p>\n

      Additional<\/u><\/b> I highly recommend the author's course from TS Solution \u2014 Check Point Remote Access VPN<\/a><\/noindex> it reveals Check Point technologies in terms of VPN, addresses licensing issues, and contains detailed instructions for setup.<\/p>\n

      <\/p>\n

      2. Remote Access for a small office<\/h3>\n

      \nWe will begin organizing remote connectivity to your office:<\/p>\n

        \n
      1. For users to build a VPN tunnel with the gateway, you need to have a public IP address. If you have already completed the initial setup (2 articles<\/a><\/noindex> from the cycle), typically the External Link is already active. You can find this information by going to the Gaia Portal: Device \u2192 Network \u2192 Internet<\/b>\n

        \"4.
        \n<\/p>\n

        In the case that your company uses a dynamic public IP address, you can set up Dynamic DNS. Go to Device <\/strong>\u2192 DDNS & Device Access<\/strong>\n<\/p>\n

        \"4.
        \n<\/p>\n

        Currently, support exists from two providers: DynDns and no-ip.com. To activate the option, you need to enter your credentials (username, password).\n<\/p>\n<\/li>\n

      2. Next, we will create a user account, which will be useful for testing the settings: VPN \u2192 Remote Access \u2192 Remote Access Users<\/strong>\n

        \"4.
        \n<\/p>\n

        In the group (using the example: remoteaccess), we will create a user by following the instructions in the screenshot. The account setup is standard; we set a username and password, and additionally enable the Remote Access permissions option. \n<\/p>\n

        \"4.
        \n<\/p>\n

        If you have successfully applied the settings, two objects should appear: a local user and a local user group.<\/p>\n

        \"4.<\/li>\n

      3. The next step is to go to VPN \u2192 Remote Access \u2192 Blade Control. <\/strong>Make sure that your blade is enabled and traffic from remote users is allowed.\n

        \"4. <\/li>\n

      4. *The above provided the minimum set of steps to configure Remote Access. But before we test the connection, let's explore additional settings by going to the tab VPN \u2192 Remote Access \u2192 Advanced. <\/strong>\n

        \"4.
        \n<\/p>\n

        Based on the current settings, we can see that remote users will receive an IP address from the network 172.16.11.0\/24 upon connection, thanks to the Office Mode option. This is sufficient for using 200 concurrent licenses (as specified for the 1590 NGFW Check Point). \n<\/p>\n

        <\/p>\n

        Option \u2018Route Internet traffic from connected clients through this gateway\u2019<\/i> is optional and is responsible for routing all traffic from the remote user through the gateway (including connections to the Internet). This allows inspecting the user's traffic and protects their workstation from various threats and malware. \n<\/p>\n<\/li>\n

      5. *Working with access policies for Remote Access. \n

        After we configured Remote Access, an automatic access rule was created at the Firewall level, which can be viewed by going to the tab: Access Policy \u2192 Firewall \u2192 Policy. <\/strong><\/p>\n

        \n\"4.
        \n<\/p>\n

        In this case, remote users who belong to the previously created group will be able to access all internal resources of the company; note that the rule is located in the general section \u2018Incoming, Internal and VPN traffic\u2019<\/i>. To allow VPN users\u2019 traffic to access the Internet, a separate rule will need to be created in the general section of \u2018Outgoing access to the Internet\u2019.<\/i>\u201d.<\/p>\n<\/li>\n

      6. \n

        Finally, we need to ensure that the user can successfully create a VPN tunnel to our NGFW gateway and access the internal resources of the company. For this, it is necessary to install the VPN client on the testing host, and it is provided link<\/a><\/noindex> for download. After installation, the standard procedure for adding a new site must be followed (the public IP address of your gateway is specified). For convenience, the process is presented in a GIF format.<\/p>\n

        \n\"4.
        \n
        \nOnce the connection is established, let's check the received IP address on the host machine using the command in CMD: ipconfig<\/i><\/p>\n

        \"4.
        \n<\/p>\n

        We confirmed that the virtual network adapter received an IP address from the Office Mode of our NGFW, and packets are sent successfully. To wrap up, we can navigate to the Gaia Portal: VPN \u2192 Remote Access \u2192 Connected Remote Users<\/strong>\n<\/p>\n

        \"4.
        \n<\/p>\n

        The user 'ntuser' appears as connected; let's check the event logging by going to Logs & Monitoring \u2192 Security Logs<\/strong>\n<\/p>\n

        \"4.
        \n<\/p>\n

        Connection logging is in progress, with the source being the IP address: 172.16.10.1 \u2014 this is the address our user obtained through Office Mode. \n<\/p>\n

        <\/p>\n

        3. Supported Clients for Remote Access<\/h3>\n

        <\/p>\n

        After reviewing the remote connection setup procedure to your office using the NGFW Check Point SMB family, I would like to discuss the support for clients on various devices:<\/p>\n

        <\/p>\n