topic Re: Integrating with NAC device such as Cisco ISE using Radius protocol for the VPN identity managem in Firewall and Security Management

Integrating with NAC device such as Cisco ISE using Radius protocol for the VPN identity management

kishorskmca_kp — Mon, 25 Jan 2021 18:49:05 GMT

we are using AD as identity management to allow users for remote access VPN. We have defined some Access Roles for serveral AD Groups in Access policy , but, we have observed every AD user can log in via VPN client (end point security), regardless the user has a security policy associated or not. If the user is not included in a security policy, of course, they are not able to access to some where, but, they still can do the log in successfully on the VPN client.

So, somehow, we would like to allow the AD authentication for remote access VPN just for those users belonging to the Access Roles or for some specific AD Groups.

Can I integrate with NAC device such as Cisco ISE using Radius protocol for the VPN identity management ?

Re: Integrating with NAC device such as Cisco ISE using Radius protocol for the VPN identity managem

RS_Daniel — Tue, 26 Jan 2021 00:07:44 GMT

Hi,

For "allow the AD authentication for remote access VPN just for those users belonging to the Access Roles" >> https://community.checkpoint.com/t5/Remote-Access-VPN/How-to-restrict-the-MS-Active-Directory-Authentication-for/m-p/80501

You have to define LDAP groups inside smartconsole and use them in remote access community to define which users/groups con authenticate trough remote access.

For "Can I integrate with NAC device such as Cisco ISE using Radius protocol for the VPN identity management ?" >> i only tested like a regurlar RADIUS server and no problem, did no try for posture or more advanced authorization policy.

Re: Integrating with NAC device such as Cisco ISE using Radius protocol for the VPN identity managem

Silesio — Tue, 26 Jan 2021 01:01:18 GMT

Take a look at this post. You don't need ISE.

https://community.checkpoint.com/t5/Remote-Access-VPN/How-To-s-Deploy-Check-Point-Remote-Access-on-Gaia-R81/td-p/103760

Regards

Silésio C.