BMD Cloud: Installing the VPN client

1. Connecting with an adapted client and certificate

2. Connecting with two-factor authentication (optional additional package)

3. Manual setup – use this only if errors occurred when using the first method!

4. Check Point Client troubleshooting

    4.1 Firewall ports

    4.2. Renew VPN certificate

    4.3 Other reasons why you might not be able to establish the VPN Connection

Detailansicht Technik1.    CONNECTING WITH AN ADAPTED CLIENT AND CERTIFICATE

Download the VPN client for the relevant BMD Cloud environment from our FTP server and start the installation.
 

Confirm the licence prompt and use the suggested installation location.
At the end of the installation, a window will appear that allows you to connect to the BMD Cloud system. 

If you are already the owner of a certificate, e.g. because you simply change your computer, this certificate must be used. Click on "Browse" to select and use the existing certificate.

If this is a clean installation, you have to go to the Check Point symbol in the task bar and right-click once on the button "Connect to...". An additional message appears that you have to click on.

A window will appear where you have to enter your password (twice). Please also enter the registration key that has been provided by the BMD tech team. 

In the future, you will need this password for connecting to the BMD Cloud system. Please make sure to remember it! Click on the button "Enroll". A certificate will be created, which you will be asked to save on your computer. Please also remember the saving location of the certificate. 

Please note! The certificate must be stored on a local drive – not on a network drive! When changing the computer, you can copy the certificate to the new computer.

Confirm the next prompts to finish the installation. The VPN client is now ready to use. You will find its yellow lock icon in the notification area of the task bar. If you double-click on the icon, you will be asked to enter the password you just set. As soon as you click on the button "Connect", a connection will be established. A green circle will appear next to the yellow lock icon, indicating that the connection to the BMD Cloud system has been established successfully.  

The next step is the installation of the Parallels Client that is required for connecting to the server. You can also find the installation guide and the required software on our FTP server. Please use the following installation guide: https://www.bmd.com/en/technical-documentation/asp-parallels-client-1.html 

You can see in the notification area that the client has established a connection.

Detailansicht Technik2.    CONNECTING WITH TWO-FACTOR AUTHENTICATION (OPTIONAL ADDITIONAL PACKAGE)

If you want to use the Check Point VPN client with two-factor-authentication, this must be prepared by the BMD tech team beforehand. The two-factor authentication is an optional package (and subject to charge) that you can use to increase security. In the VPN client, the authentication method must be set to "SecurID – PinPad". To do so, open the VPN client (yellow lock icon) in the task bar by right-clicking and select "VPN options" or "Connect to...".

Then, use "Properties" (= available under "VPN Options") or "Change Login Option Settings" (= available under "Connect to...") to change to the tab "Authentication". 

Under "Authentication", you can find the method that has to be changed to "SecurID – PinPad". The method under "BC Authentication" will change to "SecurID – PinPad" as well automatically.

Now, enter your VPN user name in the login window of "Check Point Mobile", which should be the same as the system/windows user name in the BMD Cloud. You can enter "p" for PUSH in the field "Passcode" and press ENTER (now, you will have to verify the login on your smart phone) or enter the passcode generated by the app "MobilePASS+".

Detailansicht Technik3.    MANUAL SETUP – USE THIS ONLY IF ERRORS OCCURRED WHEN USING THE FIRST METHOD!

Download the VPN client for the relevant BMD Cloud environment from our FTP server: https://ftp.bmd.com/BMD-Cloud/CheckPointVPN_manuelle_Einrichtung.msi 

In the selection, select "Check Point Mobile".

Afterwards, this icon must be visible in the notification area.

Right-click on the icon and select "Connect to...".

Next, this window will appear:

Confirm with "Yes" and click on "Next" in the next window.
Enter the data corresponding to the BMD Cloud environment and press "Next".

Austria shield-linz.bmd.com
Germany vpn.bmdcloud.de
Switzerland shield-aspch.bmd.com

 Choose the highlighted settings on the following pages and confirm them by pressing "Next".

When you reach this window, you can define a password. Enter the registration key you received from us. Then, click on the button "Enroll".

You will receive a certificate that will be used for connections from now on. You can now choose a path for saving this certificate.

Please note! If you change your computer in the future, this file will be required on the new computer.

After the subsequent operation has finished, right-click on the icon in the notification area and select "Connect" or start the connection by double-clicking on the icon.

Should the field under "Certificate File" be empty, you will have to select a certificate via the button "Browse".

Afterwards, enter the password you defined and click on "Connect".
Now, you are connected to the BMD Cloud firewall and can install the Parallels Client. Please use the following installation guide: https://www.bmd.com/en/technical-documentation/asp-parallels-client-1.html

Detailansicht Technik4.    CHECK POINT CLIENT TROUBLESHOOTING

Detailansicht Technik4.1.    Firewall ports

If you have any issues creating or renewing the certificate, please check the following outgoing ports to shield-steyr.bmd.com and the port of the firewall of your choice (see section 3. Manual setup). 

UDP 500 – IKE
TCP 500 – IKE over TCP
TCP 264 – topology download was used by SecureClient
TCP 18264 – ICA certificate registration
UDP 2746 – UPD encapsulation

Detailansicht Technik4.2.    Renew VPN certificate

To renew the certificate, click on "Renew" and enter the Check Point certificate password.

Detailansicht Technik4.3.    Other reasons why you might not be able to establish the VPN Connection

•    Another VPN connection is already active.
•    The certificate is synchronised with a cloud storage (Google Drive, OneDrive, etc.) or is located on a network drive.
•    Der Check Point Mobile client is too old: simply carry out the current setup. This will update the client.