> Source: [sk116654](https://support.checkpoint.com/results/sk/sk116654) # sk116654 - Integration of Check Point Capsule Workspace and Check Point Harmony Mobile Protect applications | Property | Value | |----------|-------| | Solution ID | sk116654 | | Date Created | 2017-04-03 | | Last Modified | 2023-02-12 | | Technical Level | General | | OS | Android, iOS | | Platform | Mobile Devices | ## Solution **Table of Contents** * Introduction * How to configure / edit the policy * Background * Procedure * Available pairs of Keys and Values * Examples * Related solutions ### Introduction {#Introduction} This article explains how to configure [Check Point Capsule Workspace](https://www.checkpoint.com/products/capsule-workspace/) to use [Check Point Harmony Mobile Protect](https://www.checkpoint.com/harmony/mobile-security/mobile/) (Formerly known as SandBlast Mobile) as an enforcement factor. Administrator can now configure the Check Point Capsule Workspace to check whether Check Point Harmony Mobile Protect is installed or enabled and act accordingly (block the connection to the VPN site, wipe the VPN site, etc). This feature is available since Capsule Workspace v7.1.44.6 in Google Play (released on 23 Apr 2017) / v1002.2.28 in Apple Store (released on 22 Apr 2017). |-------------------------------------------------------------------------|-------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------| | App | Google Play | Apple Store | | Check Point Capsule Workspace | [Link](https://play.google.com/store/apps/details?hl=en&id=com.CheckPoint.SSLVpn) | [Link](https://itunes.apple.com/us/app/check-point-capsule-workspace/id522091441?mt=8) | | Check Point Harmony Mobile Protect (Formerly known as SandBlast Mobile) | [Link](https://play.google.com/store/apps/details?hl=en&id=com.lacoon.security.fox) | [Link](https://itunes.apple.com/us/app/sandblast-mobile-protect/id1006390797?mt=8) | **How to configure / edit the policy:** * #### Background {#How to configure / edit the policy - Background} Administrator can now configure the Check Point Capsule Workspace to check whether Check Point Harmony Mobile Protect is installed or enabled and act accordingly (forbid the connection to the VPN site, wipe the VPN site, etc). Policy is configured on the Security Management Server / Domain Management Server using the [GuiDBedit Tool](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk13009). Policy is defined using pairs of Keys and Values in the relevant Capsule Workspace mobile profile (which are defined in SmartDashboard - "Mobile Access" tab - "Capsule Workspace Settings"). {#How to configure / edit the policy - Background} * #### Procedure {#How to configure / edit the policy - Procedure} 1. Connect with SmartDashboard to Security Management Server / Domain Management Server. 2. Go to ***File*** menu - click on ***Database Revision Control...*** - create a revision snapshot. Note: Database Revision Control is not supported for VSX objects ([sk65420](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk65420)). In addition, refer to: * [sk108902 - Best Practices - Backup on Gaia OS](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108902) * [sk91400 - System Backup and Restore feature in Gaia](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk91400) * [sk54100 - How to back up your system on SecurePlatform](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk54100) * [sk98153 - How to take a snapshot of Endpoint Security Management Server database](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98153) 3. Close all SmartConsole windows (SmartDashboard, SmartView Tracker, SmartView Monitor, etc.). Verify by running the "*cpstat mg* " command on Security Management Server / in the context of *each* Domain Management Server. 4. Connect with [GuiDBedit Tool](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk13009) to Security Management Server / Domain Management Server. 5. In the upper left pane, go to ***Table*** - ***Other*** - ***mobile_profiles***. 6. In the upper right pane, select the relevant Capsule Workspace mobile profile (select ***Default_Profile*** if there are no additional configured profiles). 7. Press CTRL+F (or go to ***Search*** menu - ***Find*** ) - paste ***future_compatibility_fields*** - click on ***Find Next***. [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/1.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/1.png "Click the image to see it in full size in a new tab/window") 8. In the lower pane, **double-click** on the ***future_compatibility_fields*** - do not enter / change anything - just click on OK. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/2.png) Two new lines will be added: * `field_name` * `field_value` [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/3.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/3.png "Click the image to see it in full size in a new tab/window") **Note** : If an additional pair of Key and Value is required, then again **double-click** on the ***future_compatibility_fields*** - do not enter / change anything - just click on OK. [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/4.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/4.png "Click the image to see it in full size in a new tab/window") 9. To configure a desired pair of Key and Value: 1. Right-click on the ***field_name*** - select ***Edit...*** - enter the name of the desired **Key** (case sensitive; refer to the "Available pairs of Keys and Values" section below) - click on ***OK**.* [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/5.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/5.png "Click the image to see it in full size in a new tab/window") ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/6.png) 2. Right-click on the ***field_value*** - select ***Edit...*** - enter the desired **Value** of the key (case sensitive; refer to the "Available pairs of Keys and Values" section below) - click on ***OK**.* [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/7.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/7.png "Click the image to see it in full size in a new tab/window") ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/8.png) 3. Result: [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/9.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/9.png "Click the image to see it in full size in a new tab/window") 10. Save the changes: go to ***File*** menu - click on ***Save All***. 11. Close the GuiDBedit Tool. 12. Connect with SmartDashboard to Security Management Server / Domain Management Server. 13. Install the policy onto the relevant Security Gateway / Cluster object. 14. In ***Capsule Workspace***, connect to the relevant Site to get the updated policy. {#How to configure / edit the policy - Procedure} * #### Available pairs of Keys and Values {#How to configure / edit the policy - Available pairs of Keys and Values} **Note:** Names and Values of the Keys are case sensitive. |---|---------------------------------|-----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | # | Key | Accepted Values | Description | | 1 | *protect_policy_enabled* | * `true` | Main mandatory key - enables the ability to configure policy for Capsule Workspace to check whether Harmony Mobile Protect is installed or enabled and act accordingly (forbid the connection to the VPN site, wipe the VPN site, etc). If other keys are not defined, then the default behavior of Capsule Workspace will be as follows: |-----------------------------------------|-----------------------------------|--------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------| | Detected Risk | Action taken by Capsule Workspace | Report to Security Gateway | Notes | | Harmony Mobile Protect is not activated | Block connection to Site | Report about this incident is sent to Security Gateway | The following Keys and default Values will be used: * `protect_not_activated_action=block` * `protect_not_activated_report=true` | | High risk threat was detected | Block connection to Site | Report about this incident is sent to Security Gateway | The following Keys and default Values will be used: * `protect_high_risk_action=block` * `protect_high_risk_report=true` | | | 2 | *protect_not_activated_action* | * `none` * `block` * `wipe` | Which action should Capsule Workspace perform when it detects that Harmony Mobile Protect is not activated: * `none` = do not take any action (ignore) * `block` = block connection to Site * `wipe` = wipe (delete) the connection settings to Site | | 2 | *protect_not_activated_report* | * `true` * `false` | Should Capsule Workspace send a report about the incident (Harmony Mobile Protect is not activated) to Security Gateway? * `true` = send a report * `false` = do not send any report This key is optional (if the key *protect_not_activated_action* was defined). | | 2 | *protect_not_activated_message* | * free text | Desired free text message that will be displayed to a user about the incident (Harmony Mobile Protect is not activated). If action is set to "none", then the pop-up message will have the options "Continue Anyway" and "Sign Out". This key is optional (if the key *protect_not_activated_action* was defined). | | 3 | *protect_high_risk_action* | * `none` * `block` * `wipe` | Which action should Capsule Workspace perform when it detects a High Risk threat: * `none` = do not take any action (ignore) * `block` = block connection to Site * `wipe` = wipe (delete) the connection settings to Site | | 3 | *protect_high_risk_report* | * `true` * `false` | Should Capsule Workspace send a report about the incident (High Risk threat was detected) to Security Gateway? * `true` = send a report * `false` = do not send any report This key is optional (if the key *protect_high_risk_action* was defined). | | 3 | *protect_high_risk_message* | * free text | Desired free text message that will be displayed to a user about the incident (High Risk threat was detected). If action is set to "none", then the pop-up message will have the options "Continue Anyway" and "Sign Out". This key is optional (if the key *protect_high_risk_action* was defined). | {#How to configure / edit the policy - Available pairs of Keys and Values} ### Examples {#Examples} > ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116654/sk_example202302131243461.png) ### Related solutions {#Related solutions} * [sk109314 - Capsule Workspace Extended Profile Configuration](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk109314) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content