topic Re: Session Expiration-Captive Portal-Identity Awareness in Firewall and Security Management

Session Expiration-Captive Portal-Identity Awareness

sukruozdemir — Wed, 14 Jun 2023 06:05:09 GMT

Hello,
I have two 23500 R81.10 firewalls running in cluster mode. When I install a policy, the authentications of people who have verified themselves in Captive Portal drop. They have to login again.

In addition, even though the session timeout period that I set on the gateway for Linux users who have to use Captive Portal does not expire, session times expire at irregular time intervals.

It is unfortunate that Linux distributions do not have Identity Agent and VPN Client.

Best wishes
Sukru Ozdemir

Re: Session Expiration-Captive Portal-Identity Awareness

PhoneBoy — Wed, 14 Jun 2023 18:20:48 GMT

As far as I know, authenticated users shouldn't disappear on a policy installation.
As an example, see: https://support.checkpoint.com/results/sk/sk79060
As such, I recommend a TAC case: https://help.checkpoint.com

On the more general subject of Linux users with Identity Awareness, they can be authenticated with Active Directory like Windows machines.
Which means you should be able to use Identity Collector or Kerberos to acquire the identities.
That assumes the Linux machines are tied into Active Directory, of curse.

To the best of my knowledge there are no plans to implement a native VPN client or Identity Awareness client for Linux.
Requests for these items should be discussed with your local Check Point office.

Re: Session Expiration-Captive Portal-Identity Awareness

sukruozdemir — Thu, 15 Jun 2023 07:45:51 GMT

I was thinking that I can solve it without opening a case so that users do not fall in policy installation, but it turns out that I will have to open a case.
Collecting from AD with collector is not always a good solution for Linux users. We are using Exchange Server in our local, when the person using the computer logs in to a different e-mail address other than his own via /owa, the information he receives from collector AD changes and I begin to see it as if the common mail account is using that computer.
Installing an agent on the client is the most guaranteed solution for me, but unfortunately there is no agent even though there are many users on the linux side.

Thank you for your response
Best wishes
Sukru

Re: Session Expiration-Captive Portal-Identity Awareness

Ruan_Kotze — Thu, 15 Jun 2023 08:44:11 GMT

Hi Sukru,

A workaround might be to schedule a cron job that enumerates the Netlogon share on a DC for example. Anything that will cause a login event to be created, really. You'd have to be mindful of password expiry and account lockouts though.

Thanks,
Ruan

Re: Session Expiration-Captive Portal-Identity Awareness

sukruozdemir — Fri, 16 Jun 2023 06:35:50 GMT

Hello Ruan,
Thank you for the information.
Kind regards
Sukru