topic Endpoint Security VPN client : enforce both RSA authentication and certificate check in Endpoint

Endpoint Security VPN client : enforce both RSA authentication and certificate check

Kenny_De_Man — Wed, 30 Jan 2019 14:12:05 GMT

Hi,

I'm looking for a possibility to get the following working:

- RSA authentication to identify the user and check if user is authorized or not to connect remotely

- additionally a certificate should be checked to verify if this is effectively a managed workstation of our company.

Machine authentication seems to be an option, only after installing a custom patch. Could we enforce the certificate check using an other method?

Tried looking for some doc on these features but came up empty.

Any one who can point us in the right direction?

In the post on E80.89 release I noticed a screenshot stating 'certificate check passed, additional authentication required with a username/pwd field displayed => exactly what we want (if additional authentication can be done by RSA then)

Re: Endpoint Security VPN client : enforce both RSA authentication and certificate check

PhoneBoy — Thu, 31 Jan 2019 03:19:14 GMT

The client (from E80.71 above) supports this option.

It requires a specific gateway hotfix to activate.

See: Machine Certificate Installation on Security Gateway for Authentication to VPN Clients

You're encouraged to reach out to your local Check Point office.

Re: Endpoint Security VPN client : enforce both RSA authentication and certificate check

Kenny_De_Man — Thu, 31 Jan 2019 06:06:31 GMT

Thanks Dameon!

No way to enforce this without the custom HF?

For instance by using an other certificate or check? Our company is part of a group and all soft has to be group validated first Will set us back a couple of months... We used to rely on SCV checks but:

-rather basic security (processes can be spoofed, so can reg keys,...)

- they don’t seem to be enforced properly on the W10 wks we are planning to roll out

Re: Endpoint Security VPN client : enforce both RSA authentication and certificate check

PhoneBoy — Thu, 31 Jan 2019 06:47:24 GMT

Authenticating with a machine certificate requires the custom hotfix, sorry.

Instead of using SCV, which is actually a legacy feature, you should try the Endpoint Compliance feature.

It offers similar checks to SCV and should work on Windows 10.