topic Re: Blocking two-factor authentication on Check Point Mobile in Firewall and Security Management

Blocking two-factor authentication on Check Point Mobile

Hllrdm — Wed, 17 Nov 2021 09:18:02 GMT

We have dual user authentication configured through an external SMS gateway that sends SMS messages to pass the second authentication for access via Check Point Mobile.
We need to restrict SMS texting to users who are not in the LDAP Remote Users group.

We explicitly set the LDAP group in the Access Role, User Group, LDAP Group in the Check Point rule, and we also specified the LDAP group in the Remote Access object.

But users still get text messages and after entering a text message, access via Check Point Mobile disappears "Negotiation with site failed". Is there an option at Check Point to check the LDAP group first and if the user is found in the LDAP group, then an SMS message is sent to him afterwards?

Re: Blocking two-factor authentication on Check Point Mobile

PhoneBoy — Fri, 19 Nov 2021 17:50:53 GMT

You need to define multiple login options: one that just does the LDAP lookup, and one that does both LDAP plus SMS.
The client will be able to choose which authentications scheme to use.
Refer to the Configuring Multiple Log-in Options section of: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_MobileAccess_AdminGuide/Topics-MABG/User-Authentication.htm?Highlight=Configuring%20Multiple%20Log-in%20Options

Re: Blocking two-factor authentication on Check Point Mobile

Hllrdm — Mon, 29 Nov 2021 08:56:43 GMT

We only need to use two-factor authorization. The first factor is LDAP, the second SMS.
No LDAP/two-factor authentication option.
Is this option available to solve the original problem?

Re: Blocking two-factor authentication on Check Point Mobile

PhoneBoy — Mon, 29 Nov 2021 20:14:54 GMT

I suspect it may be trying both authentication methods and only confirming you matched both at the end.
It's possible this is a bug and you should contact the TAC.