Checkpoint SecuRemote & Windows 7 64-bit Workaround

[pihau]

Hi All

I'm putting this in the public domain for anyone who wants to know! I use Checkpoint SecuRemote in WinXP and WinVista (both 32 bit) to access work, but decided to try Windows 7 x64 - it's a great OS and I can finally access all 4Gb of RAM - but I've had a helluva time getting SecuRemote to work. In the end I decided:

- SecuRemote is NOT compatible with 64bit Win7
- SecuRemote works with the XP mode install but is not worth the memory/CPU footprint (not to mention VirtualPCbeta won't let me use my old MSDOS/Win31/Win9x/Win2k virtual machines)
- SecuRemote only seems to work from WinXP when installed in virtual PC 2007

Here's what happened:

The "SR_GUI" process would not start up properly in my install of Win7x64 (even with clean install), and the gold key icon would not appear as it should in the taskbar notification area. After some digging around I found this was because the services that "SR_GUI" required were not started ("SR_Service" and "SR_Watchdog"). When I tried to start these services manually in services.msc I got "Error 1075: The service could not be started because the dependencies are missing or have been marked for deletion". I found out the dependent drivers these services needed were "VPN-1" (VPN-1 Module, file "vpn.sys), "FW1" (SecuRemote Miniport driver, file "fw.sys") and "CP_OMM" (CheckPoint Office Manager Module, file "omdrv.sys). These are all Checkpoint files and are copied over during the client install. By default these files were placed in the 64bit windows driver folder(C:\windows\syswow64\drivers) and did not appear in the dependencies tab of the service properties in "services.msc". I copied the files over to the C:\windows\system32\drivers folder and the "VPN-1" dependency was then recognised in the service properties but the other two dependencies were not. I tried dropping copies in various other folders but without success. I can only assume that "fw.sys" and "omdrv.sys" are not 64bit compatible and Win7 cannot Load them. I haven't downloaded Win7x32 to try it, but that kind of defeats the main reason for going 64 bit (ie: more RAM).

BTW I tried "SC_NGX_R60_HFA2_630000044" and "VPN-1_SecureClient_NGX_R60_HFA_02_Supplement_3_630002002" clients, both of which are later software revisions.

As a workaround I installed a spare copy of WinXP 32bit in VirtualPCx64 2007 and installed Client SC_NGX_R60_HFA2_630000044. At First the client wouldn't connect but changing the network card in the VPC settings to my network adaptor (instead of "Shared Networking") finally got the client to connect and work properly (I assume the extra layer of software when shared networking was enabled somehow prevented the client from connecting). For VPN purposes it doesn't matter that the Virtual PC emulated hardware isn't very fast, remote desktop still performs as expected.

From googling over the last week or so I got the impression a lot of people were having problems with the Checkpoint software, particularly the Error 1075 with Vista32/Vista64 and XP64 which confused me for a while.

Hope this helps someone.

Cheers,

Wil
-------

 

[ccatlett1984]

do you use visitor mode?

 

[pihau]

do you use visitor mode?

The client would not start in the first place, so I couldn't configure visitor/connect mode.

The checkpoint website wasn't that helpful, I suppose they leave it to IT staff to figure these things out.

If anyone else has had similar problems I'd be keen to hear your solutions!

Cheers

 

[ccatlett1984]

The sad thing is that I am one of those "IT staff" checkpoint doesnt seem to be supporting any 64bit platform at this point.

 

[bajanz]

Virtualbox

Works for me: Virtualbox on Vista X64 with Securemote in an XP 32 guest.

 

[thecagatay]

Hi,

I have installed windows 7 64 bit. It works great. But I need to connect my work network in order to work remotely. I used "VPN-1_SecureClient_NGX_R60_HFA_02_Supplement_3_630002002" in 32 bit vista and it works OK. But this software didn't work in windows 7 64 bit. So I try the virtual PC that Microsoft offers. They say you can run 32 bit XP applications from this virtual PC. They call the method XP mode. When you click application from the windows 7 start up, it runs virtual PC and runs the application. So I can see the icon of secure client in my tray. I connect to work by clicking this icon. But I couldn't connect to my desktop computer at work from Windows 7. When I check the IP by ipconfig program I couldn't see the checkpoint adapter in the system. So the only way that I can connect is inside the virtual PC. Is this correct or Am I doing something wrong ?

 

[ccatlett1984]

Hi,

I have installed windows 7 64 bit. It works great. But I need to connect my work network in order to work remotely. I used "VPN-1_SecureClient_NGX_R60_HFA_02_Supplement_3_630002002" in 32 bit vista and it works OK. But this software didn't work in windows 7 64 bit. So I try the virtual PC that Microsoft offers. They say you can run 32 bit XP applications from this virtual PC. They call the method XP mode. When you click application from the windows 7 start up, it runs virtual PC and runs the application. So I can see the icon of secure client in my tray. I connect to work by clicking this icon. But I couldn't connect to my desktop computer at work from Windows 7. When I check the IP by ipconfig program I couldn't see the checkpoint adapter in the system. So the only way that I can connect is inside the virtual PC. Is this correct or Am I doing something wrong ?

you need to "publish" the remote desktop client from within xp mode, so the rdp connection is made through the vpn running within xp mode.

 

[TauTau]

stuck with the same problem... also my omnikey 3121 reader will always give me a hardware installation for "Smartcard" when I insert a certificate card (though the access to the cards works, both for homebanking and Nexxus client). I'll monitor this thread in the hope of a solution someday, until that I'll have to use my XP installation on my MacBook

 

[NitroNate]

same problem here. checkpoint securemote does NOT support x64. it supports vista 32-bit, as stated on their website:

Check Point Software: VPN-1 SecuRemote/SecureClient

i'm looking for other ipsec clients that support x64, haven't found one yet.

 

[ccatlett1984]

update, checkpoint now has the SSL network extender working on 64bit os's, so this is now an option.

 

[TauTau]

hm, I guess that would be an option, if I could change dialup options at the company... which I can't

 

[ccatlett1984]

I feel for you as well, luckily we have both options at my work. I still really want a x64 full client, but since checkpoint is dropping Securemote/SecuClient for their new "end point" products, it will never happen.

 

[samurai08]

anyone got try on that option? follow the instruction given but really dont know where to extract the file as instruct.

 

[NitroNate]

i tried installing their new endpoint connect client that supersedes securemote. unfortunately, when i tried to connect to my work vpn-1 gateway, it says that it does not support the client. i'm assuming it's because the version of the vpn-1 firewall on the gateway is too old and not supported by endpoint connect. this is pretty typical of our IT staff at work, they still only "officially" support XP 32-bit, it's pathetic.

 

[TauTau]

is that this one? Check Point Endpoint Connect VPN Client I'd like to try it, but there's no download...

 

[NitroNate]

is that this one? Check Point Endpoint Connect VPN Client I'd like to try it, but there's no download...

the download is here:

https://supportcenter.checkpoint.co...tion&eventSubmit_doGetdcdetails=&fileid=10133

 

[TauTau]

thanks... when I try to create the site, I get a "does not respond"... strange...

 

[ccatlett1984]

thanks... when I try to create the site, I get a "does not respond"... strange...

the checkpoint firewall running at your place of work must be running the proper version of their software to enable the endpoint clients to connect, AFAIK

 

[TauTau]

yeah, I know... but someone else here already mentioned that he gets a "the site doesn't support this client" message when connecting, which is quite a bit different to "does not respond" I talked to IT staff and it seems there is a beta client only until now, so I'll just sit and wait...

 

[waz]

so NitoNate, did you work around this problem? i am having the exact same thing with "Site creation failed".

ok this is another thing, i am going nowhere with the checkpoint and windows 7 64bit so i thought i could try the built in vpn but it says " the device or resource (gateway site) is not set up to accept connections on port "pptp"

so on the vpn 1 edge firewall, i ticked to enable pptp but still doesn't work so i created a rule to bypass the firewall on port tcp 1723(or so i can't remember) but still doesn't work.

what can i do? please help