> Source: [sk67820](https://support.checkpoint.com/results/sk/sk67820)
# sk67820 - Check Point Remote Access Solutions - Gateway-Based Access
| Property | Value |
|----------|-------|
| Solution ID | sk67820 |
| Date Created | 2012-03-14 |
| Last Modified | 2026-09-17 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Windows, macOS, Android, iOS |
## Solution
This SK covers Check Point's remote access solution that terminate on Quantum Security Gateways.
For cloud-based/ZTNA remote access service, see [Harmony SASE - Check Point's Secure Access Service Edge (SASE) Solution](https://www.checkpoint.com/harmony/connect-sase/).
Locally managed Quantum Spark Gateways support the Remote Access VPN Software Blade. See the [Quantum Spark Locally Managed Administration Guide](https://sc1.checkpoint.com/documents/SMB_R81.10.X/AdminGuides_Locally_Managed/EN/Default.htm) \> "Configuring Remote Access Blade" section. Quantum Spark Gateways do **not** support the Mobile Access Software Blade.
**Table of Contents**
1. Providing Secure Remote Access
2. Types of Remote Access Solutions
1. SSL VPN Portal for published business application
2. Layer-3 VPN Tunnel
3. Layer-3 VPN Tunnel integrated with Endpoint Security
4. Additional Remote Access Solutions
3. Summary of Remote Access Options
4. Remote Access VPN Blade and supported OS
5. Check Point VPN License Details
(I) Providing Secure Remote Access {#Providing Secure Remote Access}
--------------------------------------------------------------------
In today's business environment, it is clear that workers require remote access to sensitive information from a variety of locations and a variety of devices. Organizations must also make sure that their corporate network remains safe and that remote access does not become a weak point in their IT security.
This article will:
* Help you decide which remote access client or clients best match your organization's requirements.
* Give you information about Check Point's secure remote access options.
(II) Types of Remote Access Solutions {#Types of Remote Access Solutions}
-------------------------------------------------------------------------
All of Check Point's Remote Access solutions provide:
* Enterprise-grade, secure connectivity to corporate resources.
* Strong user authentication.
* Granular access control.
**Factors to consider when choosing remote access solutions for your organization:**
* **L3 VPN tunnel vs. Secure Business portal:** Do you need a full VPN tunnel to protect the access from any installed application to the business, or do you need a simpler business portal that provides simple and secure access for published business applications?
* **Client-Based vs. Clientless:** Does the solution require an agent to be installed on the endpoint computer, or is it clientless, for which only a web browser is required?
* **Secure Connectivity vs. Endpoint Security:** Does the solution provide only secure connectivity, or also additional endpoint security functionalities, when the device is not connected via a VPN tunnel to the business?
### (II-1) Types of Remote Access Solutions - SSL VPN Portal for published business application {#Types of Remote Access Solutions - SSL VPN Portal for published business application}
* Allows simple and secure usage of business resources from any PC, Mac, Smartphones and tablets.
* Access business resources such as web-applications
* Two factor user authentication
* Secure access to published apps via any supported Internet Browser or a dedicated Smartphone/tablet app
* Best fit for unmanaged-devices and "BYOD"
* License required: Check Point Mobile on the Security Gateway. License count per concurrent connected devices.
 [Click here](https://supportcenter.checkpoint.com//supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk67820#SSL VPN Portal for published business application) to view details of SSL VPN Portal for published business application
|----------------------------------------------|-----------------------------------|-----------------------------------------------|---------------------|--------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|--------------------------------------|--------------|
| Name | Supported OS | Client or Clientless | Encryption Protocol | Latest Version \& Relevant Link for downloads | Security Verification for Endpoint Devices | Desktop Firewall on Endpoint Devices | IPv6 Support |
| Mobile Access Web Portal | Windows Linux macOS X iOS Android | Clientless | SSL | [R82](https://support.checkpoint.com/results/sk/sk181127) | | No | Yes |
| SSL Network Extender for Mobile Access Blade | Windows Linux macOS X | On-demand Client through Mobile Access Portal | SSL | [R82](https://support.checkpoint.com/results/sk/sk181127) [](http://supportcontent.checkpoint.com/solutions?id=sk166715) | Yes | No | |
| Capsule Workspace for iOS | iOS | Client | SSL | [sk92552](http://supportcontent.checkpoint.com/solutions?id=sk92552) | Yes Jailbreak \& Root Detection [MDM Cooperative Enforcement](http://supportcontent.checkpoint.com/solutions?id=sk98201) | No | Yes |
| Capsule Workspace for Android | Android | Client | SSL | [sk93775](http://supportcontent.checkpoint.com/solutions?id=sk93775) | Yes Jailbreak \& Root Detection [MDM Cooperative Enforcement](http://supportcontent.checkpoint.com/solutions?id=sk98201) | No | Yes |
**Notes:**
* Check Point Mobile for iPhone and iPad and Check Point Mobile for Android have been deprecated and replaced by Capsule Workspace.
* Capsule Workspace was previously named Mobile Enterprise.
### (II-2) Types of Remote Access Solutions - Layer-3 VPN Tunnel {#Types of Remote Access Solutions - Layer-3 VPN Tunnel}
* Secure access to the business from any installed application via a Layer-3 VPN tunnel
* Check Point Mobile for Windows, Check Point VPN Plugin for Windows 8.1 and Check Point Capsule VPN for Windows 10 do not support "two factor user authentication". (The limitation applies only to E80.64 and earlier in the context of Check Point Mobile for Windows.)
* Requires a VPN agent/app installation
* Best fit for both managed or unmanaged-devices
* License required: Check Point Mobile on the Security Gateway. License count per concurrent connected devices.
 [Click here](https://supportcenter.checkpoint.com//supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk67820#Layer-3 VPN Tunnel) to view details of Layer-3 VPN Tunnel
|---------------------------------------------------|-------------------------------------------------------|----------------------------------|---------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------|--------------------------------------|--------------|
| Name | Supported Operating Systems | Client or Clientless | Encryption Protocol | Latest Version \& Relevant Link for downloads | Security Verification for Endpoint Devices | Desktop Firewall on Endpoint Devices | IPv6 Support |
| Check Point Mobile for Windows | Windows Endpoint Security | Client | IPsec | [Endpoint Security Homepage](https://support.checkpoint.com/results/sk/sk117536) | Yes | No | No |
| Capsule Connect (for iOS) (previously Mobile VPN) | iOS | Client | IPsec / SSL | [sk69540](http://supportcontent.checkpoint.com/solutions?id=sk69540) | [MDM Cooperative Enforcement](http://supportcontent.checkpoint.com/solutions?id=sk98201) | No | No |
| Capsule VPN (for Android) (previously Mobile VPN) | Android 4+ Chrome OS (\* below for supported devices) | Client | IPsec / SSL | [sk84141](http://supportcontent.checkpoint.com/solutions?id=sk84141) | [MDM Cooperative Enforcement](http://supportcontent.checkpoint.com/solutions?id=sk98201) | No | No |
| Check Point VPN Plugin / Check Point Capsule VPN | Windows 8.1 | Preinstalled client | SSL | [sk96006](http://supportcontent.checkpoint.com/solutions?id=sk96006) | No | No | No |
| Check Point VPN Plugin / Check Point Capsule VPN | Windows 10 | Download app from Windows store. | SSL | [sk107536](http://supportcontent.checkpoint.com/solutions?id=sk107536) | No | No | No |
| strongSwan Client | Linux | Client | IPsec | See the Remote [Access VPN Administration Guide for your version](https://support.checkpoint.com/product/175#f-commonsource=C.%20Documentation) \> strongSwan Client Support section | No | No | No |
\* [Chrome OS Systems Supporting Android Apps](https://www.chromium.org/chromium-os/chrome-os-systems-supporting-android-apps)
### (II-3) Types of Remote Access Solutions - Layer-3 VPN Tunnel integrated with Endpoint Security {#Types of Remote Access Solutions - Layer-3 VPN Tunnel integrated with Endpoint Security}
* A full Layer-3 VPN tunnel integrated with enterprise grade endpoint security software blades.
* Two-Factor user authentication.
* Additional Endpoint Security functionalities, from Desktop Firewall to full Endpoint Security software blades, such as Disk Encryption, Media Encryption, Anti Malware, and more.
* Requires a VPN agent/app installation.
* The Endpoint Security VPN for Windows ATM MSI is appropriate for ATM solutions.
* License required: Endpoint Security Container on Endpoint Security Management Server and Endpoint Security VPN on Network Management Server. License count per installed devices.
 [Click here](https://supportcenter.checkpoint.com//supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk67820#Layer-3 VPN Tunnel integrated with Endpoint Security) to view details of Layer-3 VPN Tunnel integrated with Endpoint Security
|-------------------------------------------------|-----------------------------|----------------------|---------------------|--------------------------------------------|--------------------------------------|--------------|
| Name | Supported Operating Systems | Client or Clientless | Encryption Protocol | Security Verification for Endpoint Devices | Desktop Firewall on Endpoint Devices | IPv6 Support |
| Endpoint Security VPN for Windows | Windows Endpoint Security | Client | IPsec | Yes | Yes | No |
| Endpoint Security VPN for Mac | macOS | Client | IPsec | Yes, starting from E88.40 | Yes | No |
| Endpoint Security Suite Remote Access VPN Blade | Windows Endpoint Security | Client | IPsec | Yes | Yes | No |
| Endpoint Security Suite Remote Access VPN Blade | macOS | Client | IPsec | No | Yes | No |
### (II-4) Types of Remote Access Solutions - Additional Remote Access Solutions {#Types of Remote Access Solutions - Additional Remote Access Solutions}
* SecuRemote is a secure, but limited-function IPsec VPN client.
* Two factor user authentication
 [Click here](https://supportcenter.checkpoint.com//supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk67820#Additional Remote Access Solutions) to view details of Additional Remote Access Solutions
|------------|-----------------------------|----------------------|---------------------|---------------------------------------------------------------------------------|--------------------------------------------|--------------------------------------|--------------|
| Name | Supported Operating Systems | Client or Clientless | Encryption Protocol | Latest Version \& Relevant Link for downloads | Security Verification for Endpoint Devices | Desktop Firewall on Endpoint Devices | IPv6 Support |
| SecuRemote | Windows Endpoint Security | Client | IPsec | E84.40 ([sk171419](http://supportcontent.checkpoint.com/solutions?id=sk171419)) | No | No | No |
(III) Summary of Remote Access Options {#Summary of Remote Access Options}
--------------------------------------------------------------------------
 [Click here](https://supportcenter.checkpoint.com//supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk67820#Summary of Remote Access Options) to view summary of Remote Access Options
Below is a summary of each Remote Access option that Check Point offers. All supply secure remote access to corporate resources, but each has different features and meets different organizational requirements.
**Important:** Remote Access clients communicate with the Security Gateway through a single VPN tunnel. The VPN tunnel is not bound to a specific logged in user, and its remote access capabilities will be the same for any user/application on the client host. Multiple users on the same host are not supported, and thus Check Point does not support/recommend allowing VPN tunnels on multi-user machines such as Terminal Services.
**Note:** Refer to "[Support Life Cycle Policy](https://www.checkpoint.com/support-services/support-life-cycle-policy/)".
{#Endpoint Security Suite Remote Access VPN Blade}{#Endpoint Security VPN for Windows}{#Check Point Mobile for Windows}{#SecuRemote}{#Mobile Access Web Portal}{#SSL Network Extender for Mobile Access Blade}{#Check Point VPN Plugin for Windows 8.1}{#Check Point Mobile for iPhone and iPad}{#Capsule Workspace for iOS}{#Capsule Workspace for Android}{#Capsule Connect for iOS}{#Check Point Mobile for Android}{#Capsule VPN for Android}
|-------------------------------------------------------------------------------------------------------------|-------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Remote Access Option | Topic | Description |
| **Harmony Endpoint (former Endpoint Security Suite)** | Introduction | The Endpoint Security Suite simplifies Endpoint Security Management by unifying all endpoint security capabilities in a single console and a single client. Endpoint Security Software Blades include: Desktop Firewall and Security Verification, Full Disk Encryption, Media Encryption and Port Protection, Anti-Malware and Program Control, WebCheck browser virtualization and Remote Access VPN. Starting from Endpoint Security E80.41, Remote Access VPN Clients are part of the Endpoint Security. Remote Access Clients E75.30 (Endpoint Security VPN) replaced both SecureClient and Endpoint Connect, including 64-bit support. |
| **Harmony Endpoint (former Endpoint Security Suite)** | Required Licenses | Management: Endpoint Policy Management Software Blade. Client: Endpoint Security Container and Endpoint Security Software Blades - for any protected endpoint. **Note** - A maximum of five VPN users can only connect when using Harmony Endpoint. If you need to connect more VPN users, you should purchase additional Mobile Access licenses. |
| **Harmony Endpoint (former Endpoint Security Suite)** | Supported Platforms | Windows, macOS |
| **Harmony Endpoint (former Endpoint Security Suite)** | Where to get the Client | Check Point Support Center |
| **Endpoint Security VPN** | Introduction | Endpoint Security VPN is an IPsec VPN client that replaces SecureClient. It is best for medium to large enterprises. It provides: * Secure Connectivity * Security Verification * Endpoint Security that includes an integrated Desktop Firewall, centrally managed from the Security Management Server Note: Endpoint Security VPN for macOS X includes a Desktop Firewall, but not Security Verification. |
| **Endpoint Security VPN** | Required Licenses | The IPsec VPN Software Blade on the Security Gateway, an Endpoint Container license, and an Endpoint VPN Software Blade license on the Security Management Server. |
| **Endpoint Security VPN** | Supported Platforms | Windows, macOS X |
| **Endpoint Security VPN** | Where to get the Client | Check Point Support Center |
| **Check Point Mobile for Windows** | Introduction | Check Point Mobile for Windows is an IPsec VPN client. It is best for medium to large enterprises that do not require an Endpoint Security policy. It provides: * Secure Connectivity * Security Verification |
| **Check Point Mobile for Windows** | Required Licenses | IPsec VPN and Mobile Access Software Blades on the Security Gateway. |
| **Check Point Mobile for Windows** | Supported Platforms | Windows |
| **Check Point Mobile for Windows** | Where to get the Client | Check Point Support Center |
| **SecuRemote** | Introduction | SecuRemote is a secure, but limited-function IPsec VPN client. It provides secure connectivity. |
| **SecuRemote** | Required Licenses | IPsec VPN Software Blade on the Security Gateway. It is a ***free*** client and does not require additional licenses. |
| **SecuRemote** | Supported Platforms | Windows |
| **SecuRemote** | Where to get the Client | Check Point Support Center |
| **Mobile Access Web Portal** | Introduction | The Mobile Access Portal is a clientless SSL VPN solution. It is recommended for users who require access to corporate resources from home, an internet kiosk, or another unmanaged computer. The Mobile Access Portal can also be used with managed devices. It provides: * Secure Connectivity * Security Verification The Mobile Access Portal supplies access to web-based corporate resources. You can use the on-demand client, SSL Network Extender (SNX), via the Portal to access all types of corporate resources. |
| **Mobile Access Web Portal** | Required Licenses | Mobile Access Software Blade on the Security Gateway. **Note:** For VSX, you need only one MAB license per node, which will be replicated to all VSs. For example, if you have 10 VSs and one MAB license for 50 concurrent users then you will have 50 concurrent users per VS. |
| **Mobile Access Web Portal** | Supported Platforms | Windows, macOS X, Linux, iOS and Android |
| **Mobile Access Web Portal** | Where to get the Client | Included with the Security Gateway |
| **SSL Network Extender (SNX)** | Introduction | SSL Network Extender (SNX) is a thin SSL VPN on-demand client installed automatically on the user's machine via a web browser. It supplies access to all types of corporate resources. SSL Network Extender (SNX) has two modes: * **Network Mode:** Users can access all application types (Native-IP-based and Web-based) in the internal network. To install the Network Mode client, users must have administrator privileges on the client computer. * **Application Mode:** Users can access most application types (Native-IP-based and Web-based) in the internal network, including most TCP applications. The user does not require administrator privileges on the endpoint machine. |
| **SSL Network Extender (SNX)** | Required Licenses | Mobile Access Software Blade and IPSec VPN Blade on the Security Gateway |
| **SSL Network Extender (SNX)** | Supported Platforms | * **Network Mode:** Windows, macOS X, Linux * **Application Mode:** Windows |
| **SSL Network Extender (SNX)** | Where to get the Client | Included with the Security Gateway |
| **Check Point Capsule VPN for Windows** | Introduction | Check Point VPN Plugin for Windows 8.1 is an L3 VPN client. It supplies secure connectivity and access to corporate resources using L3 SSL VPN Tunnel. Check Point Capsule VPN on Windows 10 uses SSL. |
| **Check Point Capsule VPN for Windows** | Required Licenses | Mobile Access Software Blade on the Security Gateway |
| **Check Point Capsule VPN for Windows** | Supported Platforms | Starting from Windows 8.1 |
| **Check Point Capsule VPN for Windows** | Where to get the Client | Windows 8.1 - Preinstalled Windows 10 - [download an app from Windows store](https://apps.microsoft.com/detail/9wzdncrdjxtj?hl=en-US&gl=US) |
| **Capsule Workspace (former Check Point Mobile for iPhone and iPad)** | Introduction | Check Point Mobile for iPhone and iPad is an SSL VPN client. It supplies secure connectivity and access to web-based corporate resources and Exchange ActiveSync. Check Point Mobile for iPhone and iPad is ideal for mobile workers who have iPhone or iPad devices. |
| **Capsule Workspace (former Check Point Mobile for iPhone and iPad)** | Required Licenses | Mobile Access Software Blade on the Security Gateway |
| **Capsule Workspace (former Check Point Mobile for iPhone and iPad)** | Supported Platforms | iOS |
| **Capsule Workspace (former Check Point Mobile for iPhone and iPad)** | Where to get the Client | Apple App Store |
| **Capsule Workspace for iOS** | Introduction | Capsule Workspace for iOS is an SSL VPN client. It supplies secure connectivity and access to web-based corporate resources and Microsoft Exchange services. It also gives secure access to Capsule Docs protected documents. Capsule Workspace is ideal for mobile workers who have privately-owned smart phones or tablets. It protects only the business data inside the App and does not require device-level security measures, such as device-lock or device-wipe. |
| **Capsule Workspace for iOS** | Required Licenses | Capsule license on the Security Management |
| **Capsule Workspace for iOS** | Supported Platforms | iOS |
| **Capsule Workspace for iOS** | Where to get the Client | Apple App Store |
| **Capsule Workspace for Android** | Introduction | Capsule Workspace for Android is an SSL VPN client. It supplies secure connectivity and access to web-based corporate resources and Microsoft Exchange services. It also gives secure access to Capsule Docs protected documents. Capsule Workspace for Android is ideal for mobile workers who have privately-owned smart phones or tablets. It protects only the business data inside the App and does not require device-level security measures, such as device-lock or device-wipe. |
| **Capsule Workspace for Android** | Required Licenses | Capsule license on the Security Management |
| **Capsule Workspace for Android** | Supported Platforms | Android |
| **Capsule Workspace for Android** | Where to get the Client | Google Play Store |
| **Capsule Connect for iOS (former Mobile VPN)** | Introduction | Capsule Connect is a full L3 tunnel App that gives users network access to all mobile applications. It supplies secure connectivity and access to all types of corporate resources. |
| **Capsule Connect for iOS (former Mobile VPN)** | Required Licenses | Mobile Access Software Blade on the Security Gateway |
| **Capsule Connect for iOS (former Mobile VPN)** | Supported Platforms | iOS 6.0 + |
| **Capsule Connect for iOS (former Mobile VPN)** | Where to get the Client | Apple App Store |
| **Check Point Mobile for Android** **(Check Point Mobile is deprecated and replaced by Capsule Workspace)** | Introduction | Check Point Mobile for Android is an SSL VPN client. It supplies secure connectivity and access to web-based corporate resources and Exchange ActiveSync. Check Point Mobile for Android is ideal for mobile workers who have Android devices. |
| **Check Point Mobile for Android** **(Check Point Mobile is deprecated and replaced by Capsule Workspace)** | Required Licenses | Mobile Access Software Blade on the Security Gateway |
| **Check Point Mobile for Android** **(Check Point Mobile is deprecated and replaced by Capsule Workspace)** | Supported Platforms | Android |
| **Check Point Mobile for Android** **(Check Point Mobile is deprecated and replaced by Capsule Workspace)** | Where to get the Client | Google Play Store |
| **Capsule VPN for Android (former Mobile VPN)** | Introduction | Capsule VPN for Android devices is an L3 VPN client. It supplies secure connectivity and access to corporate resources using L3 IPSec/SSL VPN Tunnel. |
| **Capsule VPN for Android (former Mobile VPN)** | Required Licenses | Mobile Access Software Blade on the Security Gateway |
| **Capsule VPN for Android (former Mobile VPN)** | Supported Platforms | Android 4 + (ICS+) |
| **Capsule VPN for Android (former Mobile VPN)** | Where to get the Client | Google Play Store |
#### *Which license is required to allow L2TP VPN tunnels*
* **Question:** To allow L2TP VPN tunnels, if the customer already has the Endpoint VPN Remote Access Blade - is this enough, or is there a Mobile Access Blade license required? Meaning, for L2TP, do we need a Endpoint VPN Client license or a Mobile Access License?
* **Answer:** In order to allow L2TP VPN tunnels, you would just need the IPSec VPN license on the Security Gateway. There is no need for the Mobile Access License.
(IV) Remote Access VPN Blade and Supported OS {#Remote Access VPN Blade and Supported OS}
-----------------------------------------------------------------------------------------
 [Click here](https://supportcenter.checkpoint.com//supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk67820#VPN Client Version and Supported OS) to view details of VPN Client Version and Supported OS
**Note:** Remote Access VPN Blade does *not* support Windows Server OS.
|----------------------------------------|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Product | Client OS | Download |
| **Remote Access VPN Client** | Windows | **[sk117536 - Endpoint Security Homepage](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk117536)** |
| **Remote Access VPN Client** | macOS | **[sk117536 - Endpoint Security Homepage](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk117536)** |
| Check Point Mobile for iPhone and iPad | iOS | See [AppStore](http://itunes.apple.com/us/app/check-point-mobile/id386521721?mt=8) |
| Capsule Workspace | iOS | See [AppStore](https://itunes.apple.com/us/app/mobile-enterprise/id522091441?mt=8) |
| Capsule Workspace | Android | See [Google Play Store](https://play.google.com/store/apps/details?id=com.CheckPoint.SSLVpn) |
| Check Point Mobile VPN for iOS | iOS | See [AppStore](http://itunes.apple.com/us/app/check-point-mobile-vpn/id506669652?mt=8) |
| Check Point Mobile for Android | Android | See [Google Play Store](https://play.google.com/store/apps/details?id=com.CheckPointVpn) |
| Check Point Mobile VPN for Android | Android | See [Google Play Store](https://play.google.com/store/apps/details?id=com.checkpoint.VPN&hl=en) |
(V) Check Point VPN License Details {#VPN License Details}
----------------------------------------------------------
Check Point offers these licenses for VPN products:
1. *CPSB-VPN*- for IPSec VPN
2. *CPSB-EP-VPN* or the*CPSB-SB-EP-VPN license feature -*for Endpoint Security Remote Access VPN
3. *CPSB-MOB -*for Mobile Access
4. *CP-CPSL-WORK or CP-CPSL-TOTAL -*for Capsule Workspace
### 1. IPSec VPN (*CPSB-VPN*) {#IPSec_VPN}
The IPSec VPN Software Blade enables Check Point Security Gateways to allow encrypted traffic to traverse the enforcement point in general. This encrypted traffic passes over Site-to-Site VPN tunnels, as well as, over VPN tunnels established by SecuRemote.
**Note:** The IPSec VPN blade enables encrypted traffic to traverse the Security Gateway; this is not limited to IPSec VPN traffic. For example, SSL traffic is also enabled. Additional licensing may still be required depending on the client license requirements as well. See below for more information.
### 2. Endpoint Security Remote Access VPN (*CPSB-EP-VPN*) {#Endpoint Security Remote Access VPN}
The Remote Access VPN Software Blade enables remote clients to connect to the network and to obtain an Office Mode IP address. For the list of supported product versions, see [Support Life Cycle](https://www.checkpoint.com/support-services/support-life-cycle-policy/#endpoint-security).
**This license is enforced based on installed endpoint clients.** Both online (actively connected via VPN) and offline (not currently actively connected via VPN) endpoint clients require a license. An Endpoint is defined as a computer instance in the Check Point secured environment.
Endpoint license bundles, such as **EP-ACCESS** or **Harmony Endpoint**, come with two licenses:
* **CPVP-VSC-5-NGX+\ CPEP-PERP CPSB-SWB** - This license allows VPN (where \ is the number of users that the license allows to connect).
* **CPEP-C-1+1000 CPSB-EP-FW+1000 CPEP-PERP CPSB-SWB** - This license does not allow VPN.
### 3. Mobile Access (*CPSB-MOB*) {#Mobile Access}
**Note** - For the MOB blade, each Security Gateway needs its own blade.
The Mobile Access Software Blade enables both client and clientless remote users to connect to the network. These users may or may not receive an Office Mode IP address, and this depends on the type of connection that the user is making.
The VPN connections permitted by this license include the following:
1. Mobile Access (also known as *SSL VPN*, and formerly known as Connectra; not supported for use with the IPSO operating system)
2. SSL Network Extender (also known as *SNX*; 'Network Mode' provides an Office Mode IP address; 'Application Mode' does not offer an Office Mode IP address)
3. Check Point Mobile for Windows
**This license is enforced based on concurrent connections.**Users connecting with one of these solutions will consume a license for the duration of the connection only. The license will be released for use by another user upon termination of the current connection.
* **CPSB-SSLVPN-5/10/50/U** - This is the string that the Mobile Access Software Blade generates.
* **CPVP-SNX-5-NGX CPSB-SWB CPSB-ADNC-M** - This is the license that allows SSL Network Extender.
By default, a Security Gateway comes with a license for **5** users. You can attach a larger blade if more users are required.
The blades come in 3 sizes: **50** , **200** , or **Unlimited** . You can attach 1 blade only. If more users are needed, you have to trade in and go to the next higher blade. For the MOB blade, each Security Gateway needs its own blade.
With a 50-blade attached, 55 concurrent users are supported; with a 200-blade attached, 205 concurrent users are allowed; and with Unlimited, an unlimited number of users are supported.
### 4. Capsule Workspace (*CP-CPSL-WORK or CP-CPSL-TOTAL*) {#Capsule Workspace}
The Mobile Enterprise Software Blades enables remote applications installed on smartphones and tablets to connect to a network and access limited network resources.
**This license is enforced by user; each user can register up to 3 devices (for example, iPhone and iPad).** Users connecting with this solution are issued a registration key for each device, which remain valid for a period of time determined by the Security Administrator.
***Which license is required to allow L2TP VPN tunnels***
**Question:** To allow L2TP VPN tunnels, if the customer already has the Endpoint VPN Remote Access Blade - is this enough, or is there a Mobile Access Blade license required? Meaning, for L2TP, do we need an Endpoint VPN Client license or a Mobile Access License?
**Answer:** To allow L2TP VPN tunnels, you would just need the IPSec VPN license on the Security Gateway. There is no need for the Mobile Access License.
*** ** * ** ***
#### More information about Office Mode
Mobile Access licenses are dependent on the client being used to connect to the Remote Access Gateway. There are 3 basic clients: SecuRemote, Check Point Mobile, and the Endpoint Security VPN client.
SecuRemote requires no additional license but does not offer an Office Mode IP. It is not designed for a large number of users.
**The Check Point Mobile client offers an Office Mode IP.**
This client uses the Mobile Access blade license on the gateway itself. By default, a gateway comes with a license for 5 users. Then you can attach a larger blade if more users are required. The blades come in 3 sizes. 50, 200 or Unlimited.
You can attach 1 blade only. If more users are needed, you have to trade in and go to next higher blade. For the MOB blade, each gateway needs its own blade. With a 50 blade attached, 55 concurrent users are supported. With a 200 blade attached, 205 concurrent users are allowed, and with Unlimited an Unlimited number are supported. The eval for this would be the "all in one" eval.
**The third client is the Endpoint Security VPN client. It offers an Office Mode IP.**
In order to use the Endpoint Security VPN client, an Endpoint Security VPN license is purchased. This license is applied to the Management server that manages the Remote Access gateways, and it creates a pool of licenses the Remote Access gateways share. This license is purchased based on the total number of endpoints. It is not a concurrent use license.
As a user connects, they are given an Office Mode IP valid for 30 days. The eval for this would be "Sandblast complete" eval. It is a 100 user eval and is additive.
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content