SecuRemote is the poor man’s VPN solution, although FW1 does not come by default with a license for SecuRemote the license is free for using it.To obtain a SecuRemote license all one needs to do is log into your Check Point User Center and download a license for it. The first difference with SecuRemote and SecureClient that comes to mind is money. Overall, the new features in SecuRemote and SecureClient bring even tighter control, security, and flexibility to client VPN deployment. In addition, NG provides the capability to perform a clientless VPN. Other options that NG provides also bear review, as Check Point has included the capability to terminate L2TP tunnels on the Check Point box. SmartDashboard adds new functionality with bidirectional rules to the SecureClient system, allowing applications to open connections to client VPN hosts through the existing encrypted tunnels. SecuRemote and SecureClient can also utilize AES-128 and AES-256 encryption. Some of these include using split DNS, encrypting internal traffic, and a number of other options. There are myriad options for the configuration and deployment of the NG client VPN. We reintroduce the differences between SecuRemote and SecureClient, and once we cover the differences, we discuss some of the advanced deployment options for both clients. There are currently no known security impacts of doing so, but if Checkpoint should release a future version that improves the behavior of their UDP tunnels, we recommend returning the setting to normal (disabling it).Check Point SecuRemote and SecureClient are excellent tools provided by Check Point for remote VPN connectivity. Security impact: Enabling this setting slightly cripples the layer size consistency checks of Clavister Security Gateway.

Of course, one also needs to actually allow the ports involved in the ruleset, but that is outside the scope of this document. This will allow the IP data length to exceed the UDP total length by up to eight bytes. ipproto=UDPĮnable the setting 'SecuRemoteUDPEncapCompat' in 'Advanced Settings'->'IP'.

DROP: rule=LayerSizeConsistency ipdatalen=92 udptotlen=84.

The SecuRemote packets are dropped with a log events like:

This IP/UDP length consistency triggers the layer consistency checks of Clavister Security Gateway. There is an additional eight bytes of IP data after the UDP data. The 'UDP total length' value in the UDP header should be the same as the 'IP data length' in the IP header. However, the SecuRemote software sets the IP data length of these packets incorrectly. Checkpoint SecuRemote can be configured to tunnel traffic through UDP port 2746.

Checkpoint securemote