topic Re: SSO standalone VPN endpoint clients in General Topics

SSO standalone VPN endpoint clients

MiniNinja — Sun, 01 Sep 2024 14:00:08 GMT

I have R81.20 and a standalone VPN endpoint client on domain computers.
The mobile portal is enabled and remote access is configured. Authentication in the client by login and password.
How do I make sure that when logging into Windows, the client connects using the password entered in Windows?

Re: SSO standalone VPN endpoint clients

the_rock — Sun, 01 Sep 2024 16:28:42 GMT

I cant recall now, but I believe there is an option somewhere either in global properties or gw object to use os password as auth method.

Andy

Re: SSO standalone VPN endpoint clients

AkosBakos — Sun, 01 Sep 2024 17:01:46 GMT

Hi @MiniNinja

Do you want to use SecureDomainLogon feature?

Akos

Re: SSO standalone VPN endpoint clients

MiniNinja — Mon, 02 Sep 2024 10:19:35 GMT

Hello @AkosBakos

I saw this option, without turning it on, I get the opportunity to enter a username, password and connection on the login screen, but at the same time to log into Windows you need to enter the password again, and the task is just to enter the password 1 time and log in to the system, and then connect to the VPN.

Re: SSO standalone VPN endpoint clients

MiniNinja — Mon, 02 Sep 2024 10:23:50 GMT

Hello @the_rock

Unfortunately, I couldn't find this option.
Everything I've read talks about the portal and the applications on it, and I need it specifically in relation to the Windows account - interaction with Windows.

Re: SSO standalone VPN endpoint clients

AkosBakos — Mon, 02 Sep 2024 10:30:39 GMT

Hi @MiniNinja

Here is an older posts about this topic:

https://community.checkpoint.com/t5/Remote-Access-VPN/Secure-Domain-Logon/td-p/127190

Have a look at on this.

Re: SSO standalone VPN endpoint clients

the_rock — Mon, 02 Sep 2024 18:53:16 GMT

Let me see if I can find it.

Andy

Re: SSO standalone VPN endpoint clients

the_rock — Mon, 02 Sep 2024 20:43:25 GMT

Apologies mate, I think I mixed something else up. I thought there an option below, but does not appear so...

Andy

Re: SSO standalone VPN endpoint clients

MiniNinja — Tue, 03 Sep 2024 06:39:21 GMT

@AkosBakos Thanks for your reply, but I did not find how to transfer authorization to Windows when using SDL. SDL apparently works separately as a VPN connection functionality before logging in, and not as SSO in its usual sense. Goal: enter your username and password 1 time and log in + connect to the VPN.

Maybe I'm missing something or misunderstood.

Re: SSO standalone VPN endpoint clients

G_W_Albrecht — Tue, 03 Sep 2024 06:56:13 GMT

https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/Configuration-Examples-for-Machine-and-User-Authentication.htm

Re: SSO standalone VPN endpoint clients

PhoneBoy — Tue, 03 Sep 2024 13:47:13 GMT

I'm fairly certain this requires Harmony Endpoint.
https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Harmony-Endpoint-Admin-Guide/Topics-HEP/User_Authentication_to_Endpoint_Security_Clients__OneCheck_.htm

Re: SSO standalone VPN endpoint clients

MiniNinja — Tue, 03 Sep 2024 14:07:07 GMT

@PhoneBoy Thanks, I already think this is the best option, but you need licenses and a dedicated management server that supports 500 connections.

Re: SSO standalone VPN endpoint clients

MiniNinja — Tue, 03 Sep 2024 14:09:01 GMT

@G_W_Albrecht Thank you, how do I understand on a standalone client authorization based on a machine certificate?

Re: SSO standalone VPN endpoint clients

G_W_Albrecht — Wed, 04 Sep 2024 07:08:47 GMT

You will understand if you read the referenced document - it contains SDL, machine auth and all other config options. Machine auth makes the PC connect to RA VPN by itself, so if machine_tunnel_after_logon is enabled, after user login the RA VPN comes up without user intervention.

Re: SSO standalone VPN endpoint clients

MiniNinja — Wed, 04 Sep 2024 08:04:09 GMT

@G_W_Albrecht Thank you for your answer, as a result we get 2 options:

1) suggested by you - using machine authorization after logging in

2) suggested @PhoneBoy - Using Harmony with Disk Encryption

Re: SSO standalone VPN endpoint clients

G_W_Albrecht — Wed, 04 Sep 2024 08:11:50 GMT

First option is free, second has to be payed by seat - but if you need Harmony EPS it is a good choice !

Re: SSO standalone VPN endpoint clients

MiniNinja — Wed, 04 Sep 2024 08:58:02 GMT

@G_W_Albrecht Yes, I understand.