topic Re: MFA for smart console in Firewall and Security Management

MFA for smart console

Itzel_Gtz26 — Thu, 15 Jun 2023 22:43:11 GMT

Is it possible to configure an MFA for device administrators when they log in via smartconsole or from the web?

I found the following URL but it is not specified

https://www.checkpoint.com/cyber-hub/network-security/what-is-multi-factor-authentication-mfa/#TypesofMethods

Re: MFA for smart console

PhoneBoy — Thu, 15 Jun 2023 23:32:05 GMT

The easiest way to do this is with R81.20 and a SAML-based IdP like Azure AD.
See: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/SAML-Login-SmartConsole.htm

In earlier versions, it would have to be done through RADIUS/TACACS.

Re: MFA for smart console

Itzel_Gtz26 — Fri, 16 Jun 2023 00:35:14 GMT

My devices are in R81 and R81.10

Do you have the URL of how this configuration is done?

Since the only thing I found is for remote acces

Re: MFA for smart console

PhoneBoy — Fri, 16 Jun 2023 18:53:23 GMT

There isn't any specific documentation for MFA in SmartConsole in releases prior to R81.20.
The reason is that you would have to connect your desired MFA source to RADIUS/TACACS.
Using RADIUS/TACACS to authenticate SmartConsole users is well documented.
Note that you will only get a single password prompt.

Remote Access is somewhat different in that we added support for SAML Authentication in the JHFs for R80.40/R81/R81.10.
SAML Authentication for SmartConsole (where MFA is supported) was only added in R81.20.
Note that only your management needs to be in R81.20 to leverage this feature.