topic Re: Checkpoint endpoint VPN with Microsoft 2-Factor Authentication. in Firewall and Security Management

Checkpoint endpoint VPN with Microsoft 2-Factor Authentication.

edd080 — Fri, 11 Jan 2019 07:14:01 GMT

Good Day to all,

we currently have our checkpoint endpoint vpn authentication which uses username, password and dynamicid which sends an sms to the user in order to complete the logon.

We would like to change the dynamicid portion to Microsoft's two factor authentication. I am aware that a radius server is needed for this, however is there an sk or guide which can help us out on how checkpoint can be configured for this?

Thanks in advance.

Re: Checkpoint endpoint VPN with Microsoft 2-Factor Authentication.

Alex- — Fri, 11 Jan 2019 09:05:26 GMT

Which version are you using? Here are the r80.10 guides:

http://dl3.checkpoint.com/paid/87/87d47e947768228c17e5473013b23286/CP_R80.10_RemoteAccessVPN_AdminGuide.pdf?HashKey=1547…

http://dl3.checkpoint.com/paid/77/774c3c923f00c927527600aadaab3fcf/CP_R80.10_MobileAccess_AdminGuide.pdf?HashKey=1547204…

Re: Checkpoint endpoint VPN with Microsoft 2-Factor Authentication.

Chris_Atkinson — Fri, 11 Jan 2019 10:34:35 GMT

Further to the relevant sections of the admin guide please see:

sk114263: Can an Azure Multi-Factor Authentication Server be used as a RADIUS server for Mobile Access authentication?

Re: Checkpoint endpoint VPN with Microsoft 2-Factor Authentication.

edd080 — Fri, 11 Jan 2019 10:51:40 GMT

Thank you for your guides will have a look at them.

Re: Checkpoint endpoint VPN with Microsoft 2-Factor Authentication.

Simone_Balboni — Tue, 29 Jan 2019 14:58:02 GMT

Hello, curious if you succeeded in this configuration. I am on it as well with the aim of replacing an RSA AuthMgr.

Simo

Re: Checkpoint endpoint VPN with Microsoft 2-Factor Authentication.

edd080 — Mon, 11 Feb 2019 13:30:52 GMT

Hi sorry for the late reply, we still haven't got on it yet but will let you know once we get it up and running.

Re: Checkpoint endpoint VPN with Microsoft 2-Factor Authentication.

Konstantinos_In — Thu, 28 Feb 2019 13:29:43 GMT

Hello

Did you finally configure it?

BR,

Kostas

Re: Checkpoint endpoint VPN with Microsoft 2-Factor Authentication.

Simone_Balboni — Mon, 18 Mar 2019 10:22:46 GMT

Hello,

fyi this setup implies:

1) download a RADIUS proxy VM from Microsoft and configure it to talk to our Azure tenancy MFA instance

2) point checkpoint to that internal RADIUS proxy as a MFA provider

I was expecting a more direct connection i.e. Checkpoint to my Azure MFA tenancy directly, but it is not the case.

I have not yet investigated aspects like: how does the system behave if Azure MFA is down or not reachable etc? Are there emergency connection procedures etc?

Best regards,

Simone

Re: Checkpoint endpoint VPN with Microsoft 2-Factor Authentication.

Konstantinos_In — Wed, 10 Apr 2019 11:30:17 GMT

Hello Simone

Can you please kindly share checkpoint configuration and NPS configuration or some hints?

As concerns emergency procedure you could configure another Login option on checkpoint vpn client with one factor authentication.

BR,
Kostas

Re: Checkpoint endpoint VPN with Microsoft 2-Factor Authentication.

TOM_MORAN — Wed, 22 May 2019 20:25:50 GMT

does Checkpoint support Azure mfa in the way it does for example duo ?

any help is appreciated

Thanks

Tom

Re: Checkpoint endpoint VPN with Microsoft 2-Factor Authentication.

Rodrigo_Silva — Wed, 11 Dec 2019 17:36:07 GMT

See if this post can help you.

https://community.checkpoint.com/t5/General-Management-Topics/Checkpoint-VPN-with-Microsoft-2-Factor-Authentication/m-p/70152#M10539

Good luck.