YUBIKEY SUPPORT

K_montalvo — Fri, 23 Jul 2021 16:10:24 GMT

Hello my friends!

Does Checkpoint supports Yubikeys for 2FA ?

Thanks,

Re: YUBIKEY SUPPORT

PhoneBoy — Sat, 24 Jul 2021 20:18:08 GMT

We don’t offer specific support for Yubikey.
That said, if it has a RADIUS connector, you can probably make it work.

Re: YUBIKEY SUPPORT

K_montalvo — Fri, 30 Jul 2021 18:26:29 GMT

Hello @PhoneBoy thanks for your reply. I will try soon and will post and update of the results.

Re: YUBIKEY SUPPORT

the_rock — Fri, 30 Jul 2021 19:17:58 GMT

Thats a good point phoneboy made...if it is somehow Radius related, then I dont see why it would not work, but personally, never seen Yubikey used for 2FA. I am not even sure any other vendor supports them, but cant say 100%.

Re: YUBIKEY SUPPORT

Daniel_Kavan — Fri, 18 Jul 2025 15:33:09 GMT

Yes, but not native support.

per CP marketing - I do see support for PATs in the CP marketing. This page (https://www.checkpoint.com/cyber-hub/network-security/what-is-multi-factor-authentication-mfa/) says Yubikeys are supported. Physical Authentication Tokens: Physical authentication tokens like a smartcard, Yubikey, etc. provide possession-based authentication.
These devices may generate an OTP or connect to a device via USB, Bluetooth, or NFC to provide a second authentication factor.

Per TAC

- Check Point does not offer native support for Yubikey integration.
- Yubikeys are generally used for OTP (One-Time Password) or FIDO2/U2F authentication.
- Our products support external authentication methods such as RADIUS, TACACS, and SecurID (RSA).
- Integration with Yubikey is possible by using an external authentication manager (e.g., RADIUS, TACACS, or SecurID) that supports Yubikey.

My break down is that for:
RE: RADIUS, set up a RADIUS server or use

https://rublon.com/doc/checkpoint/

RADIUS - Update username in accept? - Check Point CheckMates

RE: TACACs set up an internal TACACS server from open source
TACACS open sources RHEL
While there isn't a single "TACACS open source RHEL" package, you can use open-source TACACS+ daemons like tac_plus from GitHub, or tacquito, also from GitHub, on Red Hat Enterprise Linux (RHEL) distributions. You'll need to compile and configure them, potentially using tools like yum and rpmbuild.
Here's a more detailed breakdown:

RE: SecureID - per phoneboy, most of the recent securID implementations use RADIUS
https://community.checkpoint.com/t5/Management/RSA-secure-ID-authentication-for-checkpoint-gateways-and/td-p/34365

Maybe, another option with SAML
https://community.checkpoint.com/t5/Remote-Access-VPN/SAML-with-Yubikey-on-Remote-Access-VPN/td-p/223099

topic Re: YUBIKEY SUPPORT in General Topics

YUBIKEY SUPPORT

Re: YUBIKEY SUPPORT

Re: YUBIKEY SUPPORT

Re: YUBIKEY SUPPORT

Re: YUBIKEY SUPPORT