topic Re: Integration FreeIPA and Checkpoint Security Gateway in Firewall and Security Management

Integration FreeIPA and Checkpoint Security Gateway

jakmic — Fri, 24 Mar 2023 11:10:04 GMT

Hello Everyone,

Me and my team from few days are trying to integrate Checkpoint Security Gateway with FreeIPA.

We have integration with Microsoft AD by LDAP Unit Object which is works.

Unfortunately, FreeIPA haven't "samAccountName" object class in directory schema, so when we try to add some users to Checkpoint Access Role we receive only blank directory tree.

We try to change Profile in FreeIPA Ldap Unit from Microsoft AD to OPSEC and Create LDAP Group with some option "Only Group in branch (DN prefix)", where we paste uid path to specific group, but log in to VPN was without success.

Somebody have any idea how to integrate this to systems?

Best regards

Jakub

Re: Integration FreeIPA and Checkpoint Security Gateway

_Val_ — Fri, 24 Mar 2023 13:56:38 GMT

Generic LDAP definitions should work.

Re: Integration FreeIPA and Checkpoint Security Gateway

jakmic — Fri, 24 Mar 2023 14:42:26 GMT

Yes, we thought the same, but no.

User Object Class in FreeIPA is "uid". We try to use another User Directory Profile, but without success to log in.

From another site, when we use old Dashboard, with attribute "uid", we receive good results.

Maybe custom User Directory Profile, but how can we create it? Only by database edit?

Re: Integration FreeIPA and Checkpoint Security Gateway

PhoneBoy — Fri, 24 Mar 2023 20:20:23 GMT

Presumably through guidbedit, it might be possible.

Re: Integration FreeIPA and Checkpoint Security Gateway

jakmic — Mon, 27 Mar 2023 06:07:40 GMT

Is there any manual or KB where this is described?

Re: Integration FreeIPA and Checkpoint Security Gateway

PhoneBoy — Mon, 27 Mar 2023 16:54:57 GMT

You can try asking the TAC about this.
However, you are ultimately trying to integrate with an LDAP directory we don't support.
Which means even if you do somehow make this work, if and when it breaks again, it won't be formally supported.

If this is a business requirement, your best bet is to work with the local Check Point office on an RFE.

Re: Integration FreeIPA and Checkpoint Security Gateway

jakmic — Tue, 28 Mar 2023 06:56:27 GMT

Finally, we integrated FreeIPA with Checkpoint

Profile: Netscape_DS - this profile has good user info mapping

First: We are integrating two environments, so we forgot about routes - all traffic were from WAN interface (on first environment traffic were accepted, on second environment traffic were drop from WAN or not occur)

Second: To use this object, we need to use LDAP Group, where important is to use good LDAP Filter

Thank you for help, for me this post/issue is solved