3

I need to connect from a Debian Stretch amd64 VM to a CheckPoint corporate VPN.

I am using it from the customer point of view, and do not know much technical details about the server side. I am using it with the CheckPoint Mobile client in Windows, and I know it accepts Web VPN connections with Firefox+Java aka SSL Network Extender.

I have tried opening it up in Firefox in Linux, but did not work. I also investigated text mode alternatives, namely the snx command line client, however CheckPoint literature clearly states direct logins from snx in the command line, are no longer supported.

I made several tests, inclusive installing the snx linux client, snxconnect and the openconnect/vpnc VPN client without much success. I also somewhat suspect the CheckPoint side besides the already convoluted process, is double-checking for the user agent, at least in my case.

What to do?

6

Ultimately, I decided to settle on authenticating with Firefox+Java (and then later on, changed mind, see the related link at the botton). The VM itself does not run Java nor a graphical interface, and I am running Firefox on a remote X server on my notebook when I need to connect to our corporate network.

The procedure is roughly:

1) Installing firefox
2) Downloading the snx Linux client installation after logging in the Web VPN client interface
3) Installing JDK
4) After everything installed, accessing the VPN URL in firefox each time you need to use the VPN.
5) Closing the VPN via firefox

As for the actual steps guide:

1) After some tests, it is evident the latest firefox version does not cut it running the Java applet.

Firefox 52 and above

Beginning with Firefox 52 (released March 2017), plug-in support is limited to Adobe Flash, and drops support for NPAPI, impacting plugins for Java, Silverlight, and other similar NPAPI based plugins.

So after testing a couple of firefox older versions, I settled for firefox 48 that will be just used to login in the VPN. Downloaded it from the firefox archives.

So in your target directory, do:

tar -jxvf  firefox-48.0.tar.bz2

Then do:

cd firefox

To prevent it from updating to a more recent version the first time you run on this directory:

sudo touch updates
sudo chattr +i updates

Note: the first time you run it, you also disable updates either with:

  • menu icon->Preferences->Advanced->Updates

or:

  • opening the URL about:preferences#advanced

and in "Firefox Updates" select the radio button: "Never check for updates"

2) If in the VPN, to get the installation file, do:

wget --no-check-certificate https://VPN_FW_HOSTNAME/SNX/INSTALL/snx_install.sh 

Alternatively, download the application from the Web VPN interface, in "Settings->Edit Native application settings SSL Network Extender: Download Installation for Linux"

snxurl

That will get you a snx_install.sh file.

You also need to select: "When signing-in launch SSL Network Extender:" change it to "automatically".

Run then:

chmod a+rx snx_install.sh
sudo ./snx_install.sh`

You will have know a /usr/bin/snx 32-bit client binary executable. Check what dynamic libraries are missing with:

sudo ldd /usr/bin/snx

For Debian, I you might need:

sudo dpkg --add-architecture i386
sudo apt-get update    

I had to install the following:

sudo apt-get install libstdc++5:i386 libx11-6:i386 libpam0g:i386

Check again if any dynamic libraries are missing (if any) with:

sudo ldd /usr/bin/snx

You can only proceed to the following point when all the dependencies are satisfied, as the Java applet uses snx behind the scenes.

3) After several unsuccessful iterations and web crawling, found it is needed to install Java 6 from Sun. So got jdk-6u45-linux-x64.bin from the Oracle site.

To install it do as root:

mkdir /usr/java
mv jdk-6u45-linux-x64.bin /usr/java
cd /usr/java
chmod a+rx jdk-6u45-linux-x64.bin
./jdk-6u45-linux-x64.bin

We won´t configure the whole system to use this Java version as it is too old. Just to use Java with Firefox later on:

sudo mkdir -p /usr/lib/mozilla/plugins
sudo ln -s /usr/java/jdk1.6.0_45/jre/lib/amd64/libnpjp2.so libnpjp2.so

Now the Java installation is finished.

4) Finally, to run firefox as a regular user do:

./firefox

If the Java Applet/SSL Network Extender does not launch itself after authentication, do "Native Applications->Connect". It will open a popup/Java Window. Wait for "Status: connected".

extender

You can then close the main FireFox window.

After the VPN being established, you can check with ip address or ifconfig you have now a tunsnx interface:

$ ip addr show dev tunsnx
14: tunsnx: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
    link/none
    inet 10.x.x.x peer 10.x.x.x/32 scope global tunsnx
       valid_lft forever preferred_lft forever
    inet6 fe80::acfe:8fce:99a4:44b7/64 scope link stable-privacy
       valid_lft forever preferred_lft forever

ip route will show you also new routes going through the tunsnx interface.

For extra convenience, you can define as your home page, the URL of the WebVPN.

5) To close the VPN, you either press the "Disconnect" button in the Java popup, or close/kill Firefox.

See related: getting Checkpoint VPN SSL Network Extender working in the command line

  • 1
    Thanks for this! This was a really well written guide on how to do all of this... still having issues with Java but this got me close. – saleetzo Dec 19 '18 at 22:57
  • @saleetzo see the related link, you might be able to get away doing it without Java if you are willing to do it from the command line. – Rui F Ribeiro Dec 19 '18 at 23:07
  • 1
    You are a good man and you guide worked great! Finally, I don't have to carry around a windows VM just for VPN. Great work and well done! – saleetzo Dec 20 '18 at 21:06
  • @saleetzo Pretty much was the same incentive, this allowed me to convince people at work I could ditch the corporate Windows requirement for good. – Rui F Ribeiro Dec 20 '18 at 22:20
0

To use the latest version of firefox, once you have installed snx_install.sh and cshell_install.sh open https://localhost:14186/id in a separate Firefox tab and add a Security Exception for site "https://localhost:14186/". Once the exception is added, you will see a unique identifier in HEX format. You can now close this tab and try to connect again.

  • It is not clear what is cshell_install.sh ; also any version of firefox? Waterfox might work. – Rui F Ribeiro Aug 28 at 10:22
  • Actually it is not evident what you are trying to do. Why the urls and the hex format? – Rui F Ribeiro Aug 28 at 14:07
  • I'm just accepting the unsigned certificate in the browser, and then the connection to the vpn works. I tested it on the latest version of Chrome and Firefox – Roberto Aug 28 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.