topic Re: IPSec MFA in Fedora 34 in General Topics

IPSec MFA in Fedora 34

rlanhellas — Thu, 04 Nov 2021 18:56:49 GMT

Today I'm using Windows 10 to connect in my company VPN. This VPN use MFA in this way:

I enter user/pass
I receive SMS or Answer a secret question.
I put sms code in checkpoint client , if I choose receive SMS.
I'm connected.

Now I'm migration to Fedora 34, and I didn't found a way to connect to my vpn using MFA, I tried some solutions like: snx cli, snxconnect in python, install checkpoint using wine. But unhappy nothing worked.

Is possible using Fedora 34 (Linux in general) with MFA in Checkpoint VPN ?

Re: IPSec MFA in Fedora 34

PhoneBoy — Thu, 04 Nov 2021 23:46:13 GMT

Your two options on Linux are SNX and StrongSWAN (the latter of which assumes R81+ gateways).
SNX doesn't support a multi-stage authentication.
Don't believe StrongSWAN does either.

Re: IPSec MFA in Fedora 34

rlanhellas — Sat, 06 Nov 2021 13:59:57 GMT

So, I don't have option, I need to use Windows or MacOS. 😞

Re: IPSec MFA in Fedora 34

G_W_Albrecht — Sat, 06 Nov 2021 14:23:51 GMT

Read along here - https://strongswan.org/ ! StrongSwan supports MFA with IKEv2 Multiple Authentication Exchanges (RFC 4739). RADIUS is one possibility i saw mentioned.

Re: IPSec MFA in Fedora 34

rlanhellas — Sat, 06 Nov 2021 18:01:30 GMT

How can I check if my company use Radius ? Unhappy I don't have access to this informations.

Re: IPSec MFA in Fedora 34

PhoneBoy — Sat, 06 Nov 2021 18:15:05 GMT

You really need to work with your IT folks on this.
They can place restrictions on the exact types of clients you’re allowed to use to connect to the gateway.
Believe their assistance will also be required to use StrongSWAN.

Re: IPSec MFA in Fedora 34

rlanhellas — Sun, 07 Nov 2021 12:20:16 GMT

Yes, I agree. But unhappy they said that Linux is not support nowdays.

Re: IPSec MFA in Fedora 34

G_W_Albrecht — Mon, 08 Nov 2021 08:06:51 GMT

Why then the change to Fedora 34 ? If the company you are working for can not provide a VPN client for Fedora 34 they also can not tell you to migrate to that OS.