Vissza az áttekintéshez

BMD Cloud: Installing the VPN client (macOS)

1. Installing the VPN client – Check Point Mobile

1.1. Installing the program

Under Settings → Security & Privacy, allow applications from identified developers.

Screenshot of the privacy and security settings – focus on the Security section "App Store and identified developers"

Download the VPN client from our FTP server:

https://ftp.bmd.com/BMD-Cloud/mac-osx/

Screenshot of a browser window showing the FTP server

Unpack the DMG files and start the installation:

Screenshot of the VPN installation; an arrow points to Endpoint_Security_VPN.pkg

If a warning with regard to the security settings appears, allow applications from identified developers once more under Settings → Security & Privacy. If the software is blocked explicitly, click Open Anyway.

"Endpoint_Security_VPN.pkg" cannot be opened because it was not downloaded from the App Store.
Privacy and security settings; arrow pointing to the "Open Anyway" button

Confirm the next security prompt by clicking Allow as well. Also install the Check Point Firewall.

This package runs a program to determine whether the software can be installed. Arrow pointing to the "Allow" button
Enable the checkbox next to "Firewall"

When the window for the firewall settings appears, open the System Preferences and allow “Check Point Firewall”. Click on “Allow” in the next prompt as well.

Notification that a system extension from "Check Point Firewall" was blocked, with options "OK" and "Open System Settings"
Note about firewall activation with arrow pointing to "Open Security Preferences"
Options in the "Privacy & Security" section with arrow pointing to "Allow"
Security prompt: "Check Point Firewall" wants to filter network content – arrow pointing to "Allow"
Prompt to close the "Endpoint Security VPN" app with arrow pointing to "Close & Reopen"

Finally, check whether the applications have Full Disk Access.

Enable "Check Point Firewall" and "Endpoint Security VPN" in the Privacy & Security section

If the programs are not listed, add them as explained below:

Privacy & Security section with arrow pointing to "+" under "Full Disk Access"

Sort by Date Added. Usually, this is the most helpful option.

Grouping options in the Applications section with "Added on" highlighted

2. Setting up the Check Point connection

In the menu bar, you can now find the lock icon of Check Point Mobile.

Click on the icon and select “Connect to...”.

Menu via lock icon with "Connect to..." option highlighted

Next, this window will appear:

Prompt to configure a new site with the option "Yes" highlighted

Confirm with “Yes” and click on “Next” in the next window.

Start screen of the setup wizard for sites

Enter the data corresponding to the BMD Cloud environment and press “Next”.

Site Wizard with arrow pointing to "Server address or Name"

Austria

shield-linz.bmd.com

 

Germany

vpn.bmdcloud.de

 

Switzerland

shield-aspch.bmd.com

 

Choose the highlighted settings on the following pages and confirm them by pressing “Next”.

Selection of the login option "Standard (Default)" in the Site Wizard
The screenshot shows the required settings.
Site Wizard with the "Certificate" authentication option enabled
"Certificate Authentication" section in the Site Wizard with the necessary settings
Confirmation of successful setup in the Site Wizard

The main window of the Check Point Mobile client:

Main window of the Check Point Mobile client with arrow pointing to "Click here if you don't have a certificate for this site"
Check Point Endpoint Security: Information on setting a password and requesting the registration key

PLEASE NOTE! The certificate must be stored on a local drive—not on a network drive and not in the iCloud! When changing the computer, you can copy the certificate to the new computer and delete it from the old one.

 

If several Mac users want to use the VPN connection, this is best practice: Save it to the Shared folder. After establishing the VPN connection, different users can enter the cloud in the Parallels Client. The username of the certificate is irrelevant!

Storage location of the VPN connection
Enrollment completion message with arrow pointing to "Connect"
Der Screenshot zeigt die erforderlichen Einstellungen.
Password prompt, with "Click here to allow Full Disk Access permission to TrackSrvWrapper" highlighted

Now, you must grant TracSrvWrapper Full Disk Access.

Section "Privacy & Security": Full disk access enabled for "TrackSrvWrapper"

Enter your password again in the main window of Check Point Mobile and click “Connect”.

 

Once the lock icon of Check Point Mobile in the menu bar is displayed with a permanent green circle, an active VPN connection to the login servers of BMD Cloud has been established.

Screenshot with arrow pointing to the lock icon

3. Check Point client troubleshooting

3.1. Firewall ports

If you have any issues creating or renewing the certificate, please check the following outgoing ports to shield-steyr.bmd.com and the port of the firewall of your choice (see section 2. Setting up the Check Point connection).

 

UDP 500 – IKE

TCP 500 – IKE over TCP

TCP 264 – topology download was used by SecureClient

TCP 18264 – ICA certificate registration

UDP 2746 – UPD encapsulation


3.2. Renew VPN certificate

To renew the certificate, click on “Renew” and enter the Check Point certificate password.

Certificate renewal window with arrow pointing to the "Renew" button

3.3. Other reasons why you might not be able to establish the VPN connection

  • Another VPN connection is already active.
  • The certificate is synchronised with a cloud storage (Google Drive, OneDrive, etc.) or located on a network drive.
  • The Check Point Mobile client is too old: simply carry out the current setup. This will update the client.