topic Re: Use MFA with Microsoft Authenticator in Firewall and Security Management

Use MFA with Microsoft Authenticator

tecnico — Wed, 11 Jan 2023 11:00:19 GMT

Hi,

I would like about how configure MFA using Microsoft Authenticator App in Smart Console.

I suppose that is similar than configure a SecurID.

Thanks

Re: Use MFA with Microsoft Authenticator

MvdS — Wed, 11 Jan 2023 11:11:29 GMT

Hi technico,

Check out SAML. https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_IdentityAwareness_AdminGuide/Topics-IDAG/SAML-Identity-Provider-Configuration.htm

Works great here. You can add extra checks like is machine azure ad-joined etc.

Re: Use MFA with Microsoft Authenticator

PhoneBoy — Wed, 11 Jan 2023 13:22:17 GMT

SAML Authentication for SmartConsole itself requires R81.20 and above.
See: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/SAML-Login-SmartConsole.htm?Highlight=SAML%20

Re: Use MFA with Microsoft Authenticator

tecnico — Wed, 11 Jan 2023 14:45:35 GMT

I want to configure this for Endpoint VPN loggin. It´s possible? How?

Thanks for all.

Re: Use MFA with Microsoft Authenticator

the_rock — Wed, 11 Jan 2023 14:47:58 GMT

I believe below document is what you are after.

Andy

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk172909

Re: Use MFA with Microsoft Authenticator

tecnico — Mon, 16 Jan 2023 15:47:51 GMT

Hi,

I have already applied these configuration but I have an error.

The picture shows the error.

PD: The management is a cloud SMS (Quantum Smart-1 Cloud)

Thanks for all.

Best regards.

Re: Use MFA with Microsoft Authenticator

PhoneBoy — Mon, 16 Jan 2023 23:59:33 GMT

You need to change the platform portal URL on the relevant gateway object.
The 100.100 IP address is used only for Smart-1 Cloud.

Re: Use MFA with Microsoft Authenticator

tecnico — Tue, 17 Jan 2023 07:41:36 GMT

Hi,

primary, thanks for all.

Change the 100.100 IP for my public IP is valid?

Re: Use MFA with Microsoft Authenticator

tecnico — Tue, 17 Jan 2023 08:04:29 GMT

I have already change the IP and there is a new error.

The picture shows the error.

Re: Use MFA with Microsoft Authenticator

PhoneBoy — Tue, 17 Jan 2023 17:19:23 GMT

The 100.100 IP addresses are used only by Smart-1 Cloud to communicate with your gateway.
They cannot be used in other contexts, including for the SAML configuration.
You will need to adjust these URLs in the SAML configuration as well.

Re: Use MFA with Microsoft Authenticator

tecnico — Wed, 18 Jan 2023 08:27:38 GMT

Ok.

Thanks for all.