CheckPoint SSL Network Extender or Remote Acces VPN Client for Ubuntu 12.10 Download

Question

I have been searching all around for an exact download of the VPN client software for accessing a CheckPoint VPN server on Ubuntu 12.10.

Most are useless information and guides with no helpful download links, and some links that seemed to be useful (as indicated by Google search snippets) are just dead links.

Please advise where exactly we can download the correct client, and how we can install it, and run it successfully to connect to the VPN server.

Solution

Short answer: A standalone SSL Network Extender (SNX) installer is not available from the official Check Point downloads.

SNX as a classical SSL VPN client is a thin client which is supposed to be installed over a session when you first connect from your web browser to the VPN gateway. You first authenticate to the VPN gateway using a normal web form. Then, after your agreement SNX is downloaded and installed using a Java Applet.

This means that the primary place from which is SNX distributed to client machines is the Check Point VPN gateway. Till the gateway version R75.20 there is an SNX update hotfix available on Check Point downloads with links in sk65210 - SSL Network Extender E75. Later gateway versions (R75.30 till the current R77.30) contain the up-to-date version of SNX available at the time of the gateway release but I think that SNX was not substantially updated during these gateway releases.

To be able to use SNX with the gateway there must be the correct license there (Mobile Access Blade). Also the gateway must be configured appropriately. See Mobile Access R77 Versions Administration Guide.

Further information:

• sk67820 - Check Point Remote Access Solutions - information about all the Check Point VPN clients including supported client operating systems
• sk65210 - SSL Network Extender E75 - specific information about SNX + more detailed information about JRE and library requirements on various Linux distributions

Ubuntu 12.10 is officially supported by SNX but its support by Canonical ended more than a year ago!

Comments

[ADTC]

"You first authenticate to the VPN gateway using a normal web form." Some documentation mentioned about this, but when I tried to access the gateway IP with or without port, there was nothing there. And those update hotfixes are for the VPN gateway server, correct? Not for a client. Btw, I installed a "CheckPoint Remote Access VPN Client" for Windows and was able to access VPN successfully and easily. I'm dismayed such a similar client doesn't exist for Ubuntu.

[pabouk - Ukraine stay strong]

@ADTC: ...I tried to access the gateway IP with or without port, there was nothing there. --- Please see the 4th paragraph in the answer. You specifically asked about SNX (which is currently the only officially supported Check Point VPN client for Linux - sk67820) so please ask the administrator of the VPN gateway if the SNX access is configured and working there. It could be listening on a different port than the standard 443. ------ Yes, the SNX update hotfixes are for the VPN gateway only. There is nothing available for the client.

[pabouk - Ukraine stay strong]

@ADTC: I installed a "CheckPoint Remote Access VPN Client" for Windows and was able to access VPN successfully and easily. --- This VPN client does not (need to) use SSL. So if the client works it does not mean that SNX should work too. ------ Alternatively you can try to configure a standard IPsec VPN client - for example from the SWAN family (FreeS/WAN, Openswan, strongSwan, Libreswan) but there is no official documentation for this from Check Point.

[ADTC]

I appreciate the information you're providing :) But it's still the same - a lot of information. There's no clear instruction on how to connect to this type of VPN on Ubuntu. Or how to install a compatible SNX client in Ubuntu.

[pabouk - Ukraine stay strong]

@ADTC: In such a case the information for you from all this is really simple. I would summarize it as: Ask the administrator of the gateway: 1. Is SNX configured on the gateway? 2. What is the address and the port number? 3. Is the version of SNX at least E75? Then try to connect from your web browser.

[pabouk - Ukraine stay strong]

@ADTC: We could do something like this: me: Try this. you: This is the result. me: And now try this. you: Now there is such a result. ... ------ but I think that his way does not work very well here on Stack Exchange and the profit for other users could be lower. If you are not willing to go through the available summarized possibilities then try to ask on a Check Point forum like for example: cpug.org or forums.checkpoint.com ------ I understand why practically no-one wants to answer Check Point questions here on Stack Exchange :)