Check Point Remote Access VPN Reviews

In our environment, we have many users working remotely. It's important to control the flow of traffic coming and going to these remote employees, and isolate traffic when used for business purposes. We have to allow our remote users to access services from home as though they were in the office. However, at the same time, we need to control that traffic and make sure it conforms to our policy. Our environment is complex and requires advanced policies to look at traffic in very unique ways from different users. Check Point's policy management has allowed us to do that.

At the beginning of the pandemic, everyone rushed to get their employees working from home. Luckily for us, we already had a strong structure around how remote access would work and had it set up for many employees. 

With the groundwork in place, the transition to remote work was made easy by simply adjusting the policy (configuration). In part, this is because we were already prepared for a remote workforce, and that preparation came from within our organization, however, if it weren't for Check Point enabling us to adjust rapidly, then it would not have been an easy transition.

The unified platform view is great. Being able to manage NGFW alongside our Remote Access Policies allows us to control traffic in one way. Be it if our users are at home or in the office the same policy applies to them allowing us to have one corporate view on the traffic within our organization.

Being able to integrate the policy with things like Active Directory groups, Azure cloud objects, RADIUS integration, and load balancing capabilities is wonderful. All of these things are built into their NGFW policy which we leverage to implement on our Remote Access policy.

The ability to allow split-tunneling while still following our corporate policy needs to be on the table. Right now, in order to allow the same policy to apply, the users' traffic must be routed up to our NGFW before going out to the internet. Having a method to apply the same policy to the client for outbound traffic while connected to the VPN would be huge.

Some things like the compliance aspect of the VPN Client can be updated to bring it a little more modern. It's very useful for checking things like Windows Updates levels before connecting, however, it could use a facelift since it's still quite old-looking.

I've been managing Check Point's Remote Access VPN for five years at my current employment, and had used it before at a previous employer.

The solution has been solid for me for over five years.

I get the impression this could scale up to whatever you need. Scaling issues might only be moving to clustered resources and setting up load balancing on gateways. Once you get big enough you should be able to scale up to your needs.

Support has been great 98% of the time. There's always one bad experience, yet, overall I wouldn't rate them based on that. If they need to get their experts online to help solve a problem, they have plenty and are willing to work through really deep subjects. I never worry with their support.

At our organization, we did not use another solution before this. That said, I have used other products in the past. It's been many years, so I'm sure those other vendors have had time to update their products too, however, since I've been managing Remote Access with Check Point, I've always been really impressed.

Setting up the VPN Clients is simple once you've already got the gateway in place. If you have to setup the Gateway, it will take a bit of knowledge and expertise.

Our in-house team set it up. That said, I have been working with network devices for a long time.

ROI on the VPN User license itself returns within a couple of months of you using it. However, if you have to make the investment into buying gateways for the product, then the ROI could be one year (if your whole organization is working from home), or up to three years if you barely use it.

You need to be an NGFW customer already. Otherwise, you'll need to purchase the gateways in order to terminate the VPN. That much should be obvious to anyone. Once you have the gateway in place, there is a VPN User license you need to purchase, however, it is very minimal in cost compared to other infrastructure.

We inherited the Check Point when we took over. Then, when the topic of remote access came up, it made sense to use what we had and just buy additional licensing rather than buy a whole new product.

Check Point products are typically not cheap, however, I've found it's often due to the fact that you can do a lot with it. 

I recommend Check Point products to anyone who is going to have the time and expertise to administer them. You're going to be able to do what you want to do, engineer a design that works for you. If you want to just plug it in and forget about it, then this might not be the product for you. That said, for those who do just want to plug something in and forget about it, I warn you to be cautious. When it comes to Remote Access, you don't want to ignore this. You want to be looking at it and you want to monitor it, otherwise attackers will take advantage of that weakness. This is where Check Point allows you to monitor the edge, while granularly controlling it.

We have always worked within the office. However, the COVID pandemic changed the course of our work in terms of where we had to implement new solutions so that we could all work from home. That was when I encountered Check Point; we had years with this solution in the facilities, yet, only during the pandemic did we have to innovate for a home environment. Today we have more than 6000 users working from home thanks to Check Point. This is possible due to the fact that, with a certificate and the client for this connection, every person can connect to our environment as if they were at the office.

We still have many areas of opportunity in which we must work, however, this has required us to improve our infrastructure in order to accommodate remote work. Since the beginning of the pandemic, we have had this solution and we have had many challenges since there are more than 6000 people who work from home. For security, we have an expiration time of the .p12 certificates and that requires updating passwords. Today, we are integrating this solution with a 2MFA system to give much more security to corporate.

The IPSec VPN, Mobile Access, and Identity Awareness are three of the blades with which we have been working with since the pandemic. This has given us great mobility, making our network more dynamic for connection to corporate due to the integration we have of Check Point via our AC or LDAP. 

We are creating rules by user and not by IP (which could be done both ways). We stick more to mobility inside and outside the corporate environment. Since then, corporate has been increasing security and keeping our workers happier.

The authentication that we handle is through a .p12 certificate, however, we have integrated it with a 2MFA service through another provider. Something that could improve Check Point is if it had its own 2MFA service through a blade or some sort of application. We'd be able to give a better experience to companies that already have a contract or Check Point services that deal with a work-from-home environment, giving greater scope and coverage from a single centralized dashboard.

I've used the solution for more than two years

The stability is the best.

The scalability is great.

 We have witnessed a fast response from the support team.

We did not use a different solution.

The initial setup was not overly complex.

We handled the installation in-house.

We've witnessed a 40% ROI.

The price is a little high, however, the solution is something that we recommend often.

We did evaluate other options.

We are hosting environments for our customers and ourselves. With Check Point Client, VPN users that aren't in their internal networks can connect via a secure connection into the internal network.

Remote users use different clients (Windows, Linux, and Mac OS) so depending on the customer, there is either a client connection or a clientless approach (using a web portal).

Users can also be identified if they use the Client VPN solution. If you want to identify them inside the network you have to use an IA agent.

Once set up, it simply works without issues.

The main advantage is that if you already have a Check Point Gateway in place you don't have to buy additional hardware. You only need to check if there are enough resources on the gateway for the additional load and decide how many concurrent users you need.

The installation was fairly straightforward thanks to the Admin Guide and the User Center.

Adding a Radius or similar to use for the user authentication can also easily be done so you don't have to create local users. Depending on the size of the user base I would also recommend MFA.

A normal Check Point Gateway has, with the base license, 5 concurrent users included. This means that in emergency situations you don't have to buy additional licenses.

During Covid, the license was increased and therefore it was easily possible to have several users working from home.

It's possible to either have a client installed on the user's machine, or have a clientless approach using the web portal. 

There is MEP functionality, so, based on the user's location, it minimizes the latency by connecting to the nearest entry point. 

The non-standard setup is quite complex as you have to do changes via GUI and CLI. Luckily, Check Point knowledgebase articles help you, however, there are so many resources you have to go through.

The Client VPN licenses are for concurrent users and there is currently no way to prioritize certain users over others.

There is no possibility to increase the number of concurrent users for a short time (except if you have unlimited concurrent users licensed). This could help during emergency situations where there are more client VPN users than anticipated.

I've used the product for over 7 years.

For a basic setup, implementation is quite easy.

Remote Access VPN is one of those essential items for every organization in order to maintain seamless and highly secured connectivity between the end-user and the organization's local area network to access resources - including Jump server Databases, et cetera.

No matter from which device or from which location users are accessing an organization's local resources, with the help of the Check Point VPN client they can make sure they have connected securely.

Check Point offers a best-in-class encryption algorithm to ensure confidentiality and maintain integrity between the end-user and the Gateway. 

In disaster situations like Covid-19, most users were working from home or in remote locations. In such cases, Check Point Remote Access VPN provides feasibility to everyone to work from home and access an organization's resources remotely.

With a client-less configuration known as SSL VPN users can directly access resources via a browser-like database, share folders, et cetera.

To maintain the authorization of the connected user, Check Point provides multi-factor authentication for an RA VPN client to make sure legitimate users have access to resources.

• Secure connectivity: Guaranteed authentication, confidentiality, and data integrity for every connection and user.
• Straightforward Configuration: Easy to enable blades and define policies.
• Authentication: SAML authentication makes sure the user is legitimate.
• Compliance check: It scans the endpoint machine to detect suspicious/malicious content before connecting to an office network.
• MEP: Multi entry points to make sure there's availability to the LAN network even if the primary gateway goes down.
• A single client can work as sandblast agent.

Check Point RA VPN requires companies to take separate licenses initially so that only 5 connected users licenses are given as subscriptions. Most other competitors, like Palo Alto, provide 1000 connected user licenses for free.

Some configurations, like idle timeout (the requirement came from multiple users), are not possible to configure directly from the Check Point management server. We have to make changes in the local directory of the respective devices.

I've used the solution for more than three years.

The solution is highly stable.

Check Point has an Unlimited License Package for the RA VPN and therefore we can scale it easily.

Customer service has a dedicated team that handles RA VPN cases which ultimately leads to an early resolution.

Migration has taken place such as from Cisco to Check Point and Sophos to Check Point. During that phase, the customer needed to change the VPN client as well.

Browser-based functionality is one of the best things that Check Point provides.

The initial setup is straightforward during the initial configuration.

The setup is very straightforward but subscription-based. It isn't cost-effective.

We did look at Cisco Anyconnect and Palo Alto Global Protect.

We use Check Point Remote Access VPN to provide access to employees, vendors, and advisors. They access the company resources - especially now that most people are working from home over the course of the last year. We also use it for specific companies that give us remote support to some applications, such as our parent company. Our admins access our company servers and resources. We're using Remote Access VPN with specific profiles for them that only give access to some resources.

We have three distinct environments. Server, DMZ, and User/SHOP. The firewall connects to the internet and those firewalls are the ones that the people connect to for the Remote VPN. We have the Blade enabled and they access the company resources as if they were working at the office.

The headache of connecting has been removed. It's very stable and we don't have any issues with it connecting. We have a large majority of people that were using nothing and always coming to the office. However, since the last year, we have a whopping 75% of users that have switched to using Check Point Remote Access VPN. The biggest advantage of Check Point Remote Access VPN is that we already use the Check Point firewall. We only needed to enable the feature and do the configuration in order to enable the VPN feature. We didn't need to buy or manage new hardware. This was a big advantage.

The biggest advantage of Check Point Remote Access VPN is that we already use the Check Point firewall. We only needed to enable the feature and do the configuration in order to enable the VPN feature. We didn't need to buy or manage new hardware. This was a big advantage. 

The integration with two-factor authentication for remote access users is another valuable feature. In our case we use RSA.

Those two are the most valuable aspects that we have on the solution. It also gives us the possibility to securely connect to the company resources, without Check Point security measures.

Another great thing is that we already have all the logs from the firewall on the SmartPortal as the remote VPN also integrates into the firewall. We can see all the logs on the same tool because we also have a fully secure solution for Remote Access VPN. For full operational security, we need to manage the different hardware from the firewalls and the logs that are not in the same place. This is another valuable aspect of this solution.

Having access to those logs affects our security operations because if a user calls the support but does not have access to the VPN, we can see on the same tool on the SmartPortal and troublshoot. 

We don't have any specific complaints. We are very happy with the Windows client. You log in with the VPN for the full client, you do the log in right from the software itself. For Linux machines, they don't have a full client to install. For the users that utilize Linux, there needs to be an equivalent. The documentation of the software needs to be more accessible. If an end-user wants to have access to customized training from the company, that should be able to be built-in. I would add that feature. 

I've been using the solution for around 1.5 years.

The stability is good. It's a never-fail.

The scalability is great. We deploy to 5000+ users.

It's second to none but we haven't needed it a lot. 

We used to use Fortinet. We switched because it was hard to deploy. 

Just pull the trigger on a 3rd party. Not complex at all. 

We used both a vendor and in-house talent. 

The ROI was instant and around 54%.

Go with a third party and get it set up correctly. It may be costly but it's worth it. 

We didn't evaluate anything else. I knew a vendor and had used the software before. 

Get this software installed as soon as possible. It's a smart move. 

We use Check Point Remote Access VPN to provide access to our corporate network and resources to remote users in a secure way. Users have access that is limited or defined by the server.

Access is granted for identified devices post-posture validation. 

Access should be provided via VPN using multifactor authentication other than username/credentials. Users are able to connect from anywhere at anytime using both mechanisms (i.e. User VPN client or browser). 

This solution mitigates or minimizes data leakage issues.

It is stable and scalable and requires minimal management and access provisioning.

This solution has improved our organization by providing access to corporate resources in a secure fashion. It uses complete end-to-end encryption from the end-user machine to the VPN device.

Access policies are created on the firewall for restricting access to resources and applications based on the user profile/policy.

Our security gateway is integrated with Active Directory and access to resources/applications is provided based on the security group created in Active directory.

This product has inbuild/native integration with MFA solutions.  

It does not require any additional hardware in cases where the organization already has the Check Point NGFW. The mobile access blade and remote access VPN can be enabled on the same security gateway. Check Point provides a common dashboard and management console used in conjunction with the NGFW.

Multiple access can be provided using multiple realms, based on the user ID or security group, and access can be provided accordingly. Each realm will have a pool of IP addresses for which access will be provisioned on the firewall.

Organizations that already use the Check Point NGFW Solution do not require any additional hardware, which makes the implementation straightforward and reduces the time to go live. The only requirement is to purchase an additional license from Check Point, and then enable the mobile access blade. After this, the solution is ready to roll out and provide access based on the configured policy. 

Access is restricted based on user ID, security group, and device type. 

Access is provisioned post-posture policy validation and it offers protection against users connecting to the corporate network from non-corporate devices, which minimizes data leakage possibilities. 

Access is available from browsers or VPN clients using MFA. This is helpful in cases where the machine does not have the client installed or the client is corrupted.

We are able to restrict access based on geo-location and device type. Devices can be Android, iOS, Windows, or Linux.

It provides threat prevention capabilities while uses connect via VPN for Windows devices.

Access is provisioned based on a single L3 tunnel being established between the endpoint and the VPN device. If an attacker gains access to this session then all of the tunnel traffic is compromised. It needs to move to next-generation style access, provisioning such as per-app VPN.

The GUI interface for configuring the SSL VPN is not user-friendly and requires expertise. 

Devices are exposed over the internet and it can lead to a security threat.

When a critical patch needs to be applied to the VPN, downtime is required for the entire NGFW. This can impact the business when it has a single security gateway.

This product cannot manage sudden user growth, as each security gateway has limitations in terms of performance and throughput.

The fully-featured security module is only supported on Windows and Mac systems, which means that organizations with Linux will face issues providing secure access. Specifically, modules such as Threat prevention, Access control, and Incident analysis are supported only on Windows and Mac.

It's very stable in terms of downtime, although it required updates.

The solution can be easily scaled by adding a security gateway.

The Check Point technical support is excellent.

We used Aventail SonicWALL as a standalone product. We switched because it was expensive in terms of management and maintenance. As we already had Check Point NGFW, it was easy to enable the VPN on the same device.

Enabling the VPN was simple and straightforward with the purchase of an additional license from the OEM. Once we acquired the license, it involved enabling the module on the security gateway. The solution was ready to go live within 10-15 minutes.

The implementation was completed by our in-house team with the assistance of the OEM.

Organizations that already have the Check Point NGFW need to purchase an additional license to have access to the VPN functionality.

We evaluated Pulse and Citrix before choosing this option. 

Traditional VPNs that work on L3 or L4, with a single VPN tunnel, are typically hosted on-premises. As organizations are adopting cloud computing, it makes sense to have a VPN solution hosted on the cloud for better control and security.

We primarily use this solution for our clients. Use cases vary, and they include VPN connectivity. It can be used as a provisional firewall and you can allow for a provisional access list, or grant permission to access or for servers or users trying to connect to the server. 

The VPN, the end-user client VPN, is excellent. 

The firewall experience that we have had has been good. It's secure. We've enjoyed it so far.

The initial setup is very easy. It's pretty straightforward. 

The solution is very stable.

Technical support has been excellent.

With this particular client VPN, there needs to be a feature that can glance at your credentials, of being able to look at credentials. You might hang for a bit or the execution might fail. It would be useful to see your credentials before you connect to take note to see if you are likely to have trouble connecting. They need to increase their timeout. Right now, it will fail after ten seconds, however, it shouldn't fail until after 20. If you don't get on your phone right away and check on your authentications, it will kick you out. They need to give a bit more time.

I've used the solution within the last 12 months. I've used it for a while. 

The stability has been quite good. It's very reliable. It connects. Our VPN connects over 1,200 people with no issues. There are no bugs or glitches. It doesn't crash or freeze.

I can't speak to the scalability aspect. We don't have a need to scale. We have about 1,200 users and that's all we need. Therefore, I've never tried to scale it previously.

I've worked with technical support in the past. I was surprised at how responsive they are, actually. They are very helpful and ready to assist us. They're knowledgeable. We're happy with the level of support they give to us. 

We also have a vendor right here in Nigeria, which is quite helpful.

We did not find the initial setup to be overly difficult or complex. It's pretty straightforward. A company shouldn't run into problems with the initial setup.

You do have to pay a licensing fee, however, there aren't add-ons or additional costs that you would need to consider.

We are customers and end-users. We don't have a business relationship with the company.

I'd advise new users that, when it comes to deploying with an authentication provider, I would advise that you use a Microsoft authenticator. We tried using their authenticator at first, but that is not good. That did not work.

I'd rate the solution at an eight out of ten.

The primary use case is to allow our employees to connect to the firewall on-premises, then they can access our office resources. This includes their respective computer, the intranet, shared files, and local applications, even if they are outside of the organization's network.

Our production will be locked down if my VPN stops working, leaving the company unable to work. As such, this is a crucial service for us and resources need to be available for each of our users when working remotely.

Prior to using Check Point Endpoint Remote Access VPN, our previous solution required installing certificates on every user's machine, which was a very difficult task.

Our old solution did not offer two-factor authentication, which we now have implemented. This helps secure against ongoing cyber theft and threats.

The most valuable feature is the seamless access. Using this, we control access to our on-premises resources, and our users who are working from outside are easily able to access their office area computers, file servers, and intranet applications.

This product allows us to provide WAN access for our users, whereas prior to this, we could not make the whole intranet available.

Multifactor authentication is very helpful for us.

We would like to see support for a layer seven VPN over UDP.-- currently some VPN solution are working on Layer 7 Platform.

The updates under Windows 10 are not always up to date, and we have trouble upgrading remote clients. We have also had trouble deploying new clients.-- The Check Point Remote VPN new client is giving trouble us during upgradation with older version of Windows 10

We have been using the Check Point Endpoint Remote Access VPN for the past four years.

We have had no problems with stability and it is working smoothly.

Scalability is good. We have more than 500 users who are working on it.

The technical support is good.

Earlier, we had a traditional VPN, which did not help in running our business seamlessly. 

The initial setup is straightforward.

A vendor team assisted us with implementation and deployment.

Its complete ROI, as expected. 

This is a very good solution for our employees who work outside of our organization.

We use a Check Point Endpoint Remote Access VPN client along with Check Point SSL VPN, which allows users to connect to our firewall who don't have the client, e.g., if they have a MacBook, then we don't have a client for them. We allow them to connect to the firewall over the browser. That had a bunch of problems, but they have resolved those this year. 

The use case is to allow people to connect to our firewall on-premise. We also have Check Point firewalls in the cloud, which people can connect to as well. Then they can access resources either in our on-premise environment that they need to access, such as, their computers, the Intranet, Salesforce, or our production applications. Also, in AWS, they can access other types of applications, like WorkSpaces, or our production applications there, which allows them to work. It lets them have access to their email, because they're not able to access their email unless they are VPN'd in, etc. 

We keep everything locked down to the VPN. If that's not working, then our company will not be able to work. It was very finicky last year, and it's working now. It has been perfect this year.

We don't use the Endpoint Remote Access VPN client for too much. We use its local firewall, which is valuable, but we don't really use SandBlast. I know you can add the SandBlast module along with all these other modules. We literally just use it so our users can connect on-prem.

Before we used the Check Point Endpoint Remote Access VPN solution, we were using a difficult VPN solution. It made us install a certificate on the user's laptop. That was very difficult to maintain for the IT department. When we gave out a new laptop, we would have to go and manually put the certificate on a laptop so they could then connect back to the on-prem. Where now, Check Point allows us to use an RSA token and PIN. It integrates with RSA, which is another solution that we use. RSA is a random generated key done every minute and another factor of authentication. With Check Point having that feature, it helped us a lot when we initially set it up.

The most valuable part would be allowing users to have a seamless connection to the Check Point firewall, which is what we use for controlling access to our on-premise area. Otherwise, we would have to get some other type of VPN solution that I don't know how well would work with the Check Point firewalls. Keeping it in the same ecosystem is good.

Currently, we're using Check Point Endpoint Remote Access VPN R70.30.03. That's the latest version of R70.30. We haven't upgraded to R80 yet, but all of our firewalls are R80. We've been through many iterations of the Endpoint VPN client. I remember awhile ago, it was very difficult to deploy and not have problems, but they've come a long way. Now, it's a lot better. 

I have worked so much on this in the past with Check Point that they actually had their vice president of product development call me. I remember one of the things that I told him need room for improvement, which I still haven't seen: When you want to deploy a new Check Point agent, it is really a pain in the butt. For example, Windows 10 now has updates almost every couple of months. It changes the versioning and things under the hood. These are things that I don't understand, because I'm not a Windows person. However, I know that the Check Point client is installed on the Windows machine, and if the Check Point client's not kept up-to-date, then it's functionality breaks. It has to be up-to-date with the Windows versions. Check Point has to update the client more often. Now, the problem is that the Check Point client is not easy to update on remote computers and it's not easy to deploy a new client. 

They need to improve deploying a new Endpoint Remote Access VPN client and updating existing Endpoint Remote Access VPN clients. Especially if you want to deploy a new one, it's not an easy process. Their software doesn't really support creating a new Endpoint Remote Access VPN client. There is a lot of manual activity. They need to automate it better. You have to create a generic client, download it to a computer, and install it to the computer. Then, you have to find a file deep inside the directory that it creates. It's like a text file, then you take that text file out and edit the settings in it. For example, I have to tell it to connect to a site which contains our firewalls or else it's like a phone with no phone numbers and I have to put in the phone numbers. This should be done when I download the client the first time from their GUI, but it is not. Instead, I have to install a generic blank version on a computer, find a text file, and edit the text file with the sites of firewalls that the users have to connect to specific to my company. I have to make other setting changes in that version, save it, reboot the computer, find the file again, take that file out of the computer, upload it to GUI, and deploy a new version. Then, I install it after I uninstalled the old one. Of course, all the uninstalls require reboots. So, I am rebooting it like five times now. After that, I have to install it and check the settings. Half the time they don't save the way you want them to save. It is very tedious and terrible. 

Even learning that process was a nightmare, because it's not like they have a nice article that explains it to you. They don't. I was bumping my head up against the wall with support for almost six or seven months trying to figure that out. Half of them didn't even know how to do it. That was miserable. But now that I'm an expert on it, I can probably do it within a half a day to three days depending on if it gives me problems or not. That's still miserable, and it should be as easy as: I upload the new version of the client, put in the information that I want it to have on the settings, click download, and install, then it works. It should be that easy. There's really no reason why it's not, except for they didn't improve that process nor have they developed that area. It makes me think that their interest isn't in VPN solutions, even though it should be because it's something that they offer. Otherwise, their support is great.

About seven or eight years.

Since it was fixed in November, it's been 100 percent solid and stable. It's been solid as far as Endpoint Remote Access VPN is concerned. I would say their SSL VPN isn't always solid, but I don't think it's necessarily their fault. I think it's because companies, like Apple and Google, change their browsers and operating systems. This messes up Check Point's ability to allow the connection as far as Java updates or other types of security features that they enable. They also don't let you run the application without administrative rights or in sandbox. I have seen a lot of things break because of other companies' involvement in their products. 

As far as the connection is concerned, recently it's been stable. If you had asked me that a couple years ago, it was miserable. It was like the bane of my existence. Now, it's working great. 

I manage the solution, though technically it's my team. They don't work on it if they don't have to. If they have to, then they ask me questions.

It is pretty scalable as far as adding more users. I don't see that as being an issue. All we have to do is buy more licenses and it's easy to add the license headcount, then more users can be added just as simply.

We have 200 to 250 users in our company.

We will definitely be increasing to have more users since our company was just purchased by a very large company. This will make us grow.

Their Endpoint Remote Access VPN support team tries to fix whatever problems that are there and incorporate those issues into the next Endpoint Remote Access VPN client that they release for everyone, which is great. I know that last year specifically, I worked with the Endpoint Remote Access VPN support for nine months. We were having disconnects. Some users would get disconnected from their VPN five times in a day. Throughout nine months of working with them, providing logs, providing TCP dumps from the firewall, and all the information they needed, they were able to give us a new client where our users didn't have any more disconnects. They did something where they made it more resilient. So, if there's a problem, the client has more time to talk back to the endpoint or firewall. That is huge since this entire year our whole company has been working from home. 

Last year, we had a few people working from home every week, or maybe a tenth of the company works from home permanently. However, if we hadn't fix that issue by November of last year, then having everyone work from home and getting disconnected five times a day would have been an utter nightmare. It probably would (100 percent) been the end of Check Point at our company, because I know our CIO already doesn't really like Check Point. We keep it around because my team believes in it. But if no one could work, because no one could VPN, that definitely would have been the end of Check Point.

This wasn't something they could just fix or something that I could fix or configure. It literally took nine months of troubleshooting and ongoing fixing with their development team in Israel, where they were making new code for the input client, which we got. It worked and we're still running that client today. That was huge. If I had to say something really good, it would be that their support helped us and fixed that issue.

We did use something else previously. I want to say it was some kind of a VNC Viewer things with a certificate. It's very basic and crappy. 

We switched because we need more features, like the RSA token involvement. We also like that we were using another Check Point solution and could integrate with that.

The initial setup wasn't too complex. I think their documentation is pretty good for the initial setup. It took a little while, but it wasn't difficult. We did the deployment successfully in probably two months on our own, without them doing anything, by just reading the documentation and having other stuff going on too. We didn't just focus on this deployment.

I just wished the upgrade process was easy and the configuration initial process was easier. In the past six months, they did a fix, where if I push out a new install to users, it doesn't reboot their computer. Now, it will install their client and not reboot.

They need to keep up with Windows updates faster. There have been a couple of times where Windows is updated and they didn't have a new version ready for when Windows was ready, which means the clients that are running on the newer version of Windows won't be able to VPN. If they can keep up to speed with that, then it would be good.

I've done this twice already because I know that we didn't upgrade it. I built out two new servers for it. I have a primary and a policy server. We have a primary endpoint server. Then, we have a secondary, which is called a policy server. This is operational because our clients will connect round robin to one, then the other. It's just that one of them has more precedence over the other as far as enforcing policy. We have those in two different environments, and they're virtual. All the standard things that go along with setting up a virtual environment.

We had to create the policy on the new endpoint server, which isn't too complicated. It includes a list of ports that we needed for our users to be able to use certain applications, like their chat and VoIP, because it has a local firewall. That took some time, like a week building that policy out and testing it. It's really about making sure that it can connect to the endpoint server through the main firewall. Then, it gets its policy from the endpoint server that it downloads and enforces on the local firewall, allowing for the connection to the main firewall. I wouldn't say it was too complicated as far as deployment strategy goes.

We have seen ROI. It allows everyone to work from home. If no one could work from home, then we wouldn't have a company, especially now during COVID-19. It's mission-critical, especially since it's currently being used. If there is a problem with it, we would really be screwed. We would be hard-pressed because we would have to figure out what solution we're going to go with, how to deploy it, how long it would take to deploy it, and how we'd even get it on people's computers if we couldn't VPN to them. It would be near impossible to just change to a new VPN solution right now. Without physical access to the machines, it makes things much more difficult.

My understanding is that the pricing and licensing are very competitive, and it's not one of their more expensive products. We buy licenses for the solution and have licenses for the endpoint servers.

I believe we did evaluate other option, but I know that we were leaning strongly towards Check Point.

My advice would be to have patience. Make sure you get a Tier 3 support person. Setting up the servers and everything is easy, but deploying the Endpoint VPN client is not easy. They need to have someone walk them through the process of creating the Trac file that contains the settings for the client. That is hard.

There is the endpoint server, which is on-prem, and easy to set up like any other appliance that any network engineer or systems administrator should know how to do. That is easy. But if you want to deploy the client, which most people want to deploy the client, and have any type of configured settings on it, then know that it is not just a generic client. That's the hard part. My advice would be to reach out to support and have them help you with it.

I remember not knowing how to deploy the Trac file and struggling immensely. I was unable to deploy the client and get people working, which is my job and what I'm supposed to do. Learning how to do that, being familiar with the process, and actually doing what I'm expected to do at work, which is let people be connected to the firewall, that was my biggest lesson.

I would rate it a seven and a half out of 10.

I use Remote Access VPN for clientless applications, setting up WireGuard tunnels, and WireGuard VPN as a service. It provides remote access for SIP setups, allowing users to connect securely through a VPN.

The most valuable features include application access, clientless application access, and WireGuard. These features make it easy to deploy and offer a user-friendly interface. The complexity is hidden within a full mesh network, allowing seamless user-to-application connectivity with minimal delay.

Automations for cloud integrations need to be expanded, and currently, developers have to manually configure APIs, which is not developer-centric. Improving this process could enhance the solution's scalability and efficiency.

I have used Check Point Remote Access VPN for two and a half years.

Some connectivity issues arise occasionally, especially when accessing the internet or using other applications. The installed client sometimes reconnects, possibly due to conflicts with existing VPN solutions.

The solution is extremely scalable, with an eight out of ten rating due to its mesh network and ability to build WireGuard tunnels. However, additional automation is required to enhance its enterprise features.

Customer service is excellent. Support is integrated into the product, making it easy to access without needing to search for contact information. There is an icon in the portal for online support, and Check Point local support promptly replies to queries.

Positive

On a scale of one to ten, I would rate the initial setup of Check Point Remote Access VPN as ten because it is super easy to set up.

The pricing is rated eight to 8.5 out of ten. The costs increase with the purchase of advanced features. Licensing issues need to be sorted as different features require separate licenses.

The best solution for small to medium businesses. Licensing issues need to be sorted out. For example, features like CASB and browser security should be bundled. Having automations will help scale to other scenarios.

I'd rate the solution ten out of ten.