topic Re: Duo setup with VPN remote access in Firewall and Security Management

Duo setup with VPN remote access

Tim_McColgan — Wed, 10 Jun 2020 18:16:49 GMT

My goal is to primary auth the user with LDAP then second auth with a duo push. Although the confusing part is there is RADIUS configuration required, even though I only want to use LDAP w/ Duo. Not sure I understand why but any configuration examples would be helpful!!

Here is mine today:

[ad_client]
host=1.2.3.4 (AD server IP)
service_account_username=ad-admin
service_account_password=ad-admin-password
search_dn=DC=domain,DC=com
security_group_dn="CN=Duo Checkpoint VPN,OU=Groups,DC=domain,DC=com"

[radius_server_auto]
ikey=ikey_from_duo_console
skey=skey_from_duo_console
api_host=api-123456789.duosecurity.com
radius_ip_1=checkpoint_gw1
radius_ip_2=checkpoint_gw2
radius_secret_1=secret1
radius_secret_2=secret2
client=ad_client
port=1812
failmode=secure

I am seeing the firewall logs that the radius server is not responding, but I am guess that just means it cannot properly authenticate my account. I know network-wise the gateways can reach the Duo proxy server.

Re: Duo setup with VPN remote access

PhoneBoy — Sun, 14 Jun 2020 07:52:47 GMT

Have you followed the guide Duo has for this? https://duo.com/docs/checkpoint

Re: Duo setup with VPN remote access

Tim_McColgan — Tue, 14 Jul 2020 13:46:11 GMT

I did, after a few tweaks I am up and working. Crazy enough, my fix was to remove the double quotes from the security dn.

security_group_dn=CN=Duo Checkpoint VPN,OU=Groups,DC=domain,DC=com

Re: Duo setup with VPN remote access

Shahar_Grober — Fri, 25 Sep 2020 10:29:31 GMT

Hi Tim,

did you manage to get the Duo work with Push instead of OTP?

Re: Duo setup with VPN remote access

Tim_McColgan — Fri, 25 Sep 2020 13:26:06 GMT

Yes!

Re: Duo setup with VPN remote access

Shahar_Grober — Fri, 25 Sep 2020 13:34:41 GMT

Thanks, is there a way to perform a push option without using the "Password,push"

I find it quite annoying and I would be happy to allow a seamless and cleaner user experience to our users

Re: Duo setup with VPN remote access

Tim_McColgan — Fri, 25 Sep 2020 14:07:14 GMT

Yes, in the [radius_server_auto] portion of your authproxy.cfg file you would just add this:

factors = push

You can add many factors to it, but I prefer and only use push.