VPN Cert Auth - Read OU for User Groups

OrkhanRustamli — Thu, 29 Oct 2020 10:44:40 GMT

Hi All,

We are implementing certificate authentication for remote VPN without LDAP and AD. ISE is identity store and we are using ISE`s CA feature.

The authentication is working fine, as auth is going internally in firewall but we also need user groups for policy management.

I wonder is it possible to configre CP to read OU from cert and add users to groups based on OU?

Thanks in advance!

Re: VPN Cert Auth - Read OU for User Groups

PhoneBoy — Mon, 02 Nov 2020 05:23:42 GMT

I believe we can only retrieve groups from LDAP.
However, if you're integrating with Cisco ISE, you should be able to use Identity Tags as a group source.
See: https://community.checkpoint.com/t5/Policy-Management/How-to-use-Identity-Awareness-Tags-in-R80-20-M1/m-p/17246