Kaspersky Endpoint Security Whitelist

Explanation:

Before MAB came along, SNX terminated on the IPSEC VPN blade and life was good. You browsed to the external IP, were presented with a popup window, entered your credentials and had good old network connectivity tunnelled over SSL.

Then executives jumped on the iPad / tablet bandwagon and the Mobile Access Blade was born. The MAB now intercepted all traffic and everything terminated on it. SNX appeared to no longer exist but at least the executives were happy as they could access OWA on their mobile devices. And god frowned. Now on to the good stuff:

Symptoms and Status:

• No SNX window opens when you https to your gateway’s IP – you get the Mobile Portal only
• Once you log into the portal, there is no “Connect” button to allow you proper network access

Notes / Caveats:

• Checkpoint Mobile VPN on tablets works, IP network connectivity is present.
• Not to be confused with Checkpoint Mobile- this only allows published applications. See references below for details)
• The MAB portal cannot be bypassed to provide direct access to SNX, it is necessary to sign in to MAB and then connect from there.

Fix:

In order two bring back snx, we need to:

• Specify access to each subnet we want the SNX user to be able to access
• Publish these as “Native Applications” – if there are no native applications then the “Connect” button will not be shown

1. Make sure Mobile Access Blade is selected

2. Define address ranges for each subnet you want VPN users to access:

3. Create a rule in the MAB policy to allow either a group of users or just All_Users to access the resource:

4. PUSH THE POLICY!!

5. Log in to the portal:

6. Hit the connect button

7. Connected, job done!

References:

Below are the references for android but there are also apps for iPhone and iPad in the iTunes store.

Android Mobile:

Android Mobile VPN: