topic Re: Remote Access VPN - certificate based login in General Topics

Remote Access VPN - certificate based login

AkosBakos — Wed, 02 Oct 2024 08:07:00 GMT

Hi CheckMates,

I need your help.

I have a VPN setup, where de user is authenticated by DN. The disadvantage of this, if I move the user to an another OU, the DN changes. (Un)fortunately, the user certificate is stored on an external smarcard. In this case I need to recreate the user cert and put it to the smartcard. I have 100+ users.

I changed the auth setting to UPN. The VPN connection is unsuccessful until I recreate the site. After this, everything works as expected.

How can I centrally modify the trac.config?

Every tip and advice are appreciated.

I don't have Harmony, only SCCM.

Akos

Re: Remote Access VPN - certificate based login

G_W_Albrecht — Wed, 02 Oct 2024 09:06:44 GMT

https://community.checkpoint.com/t5/Remote-Access-VPN/Possible-to-create-trac-default-from-trac-config/m-p/67880#M2165

Re: Remote Access VPN - certificate based login

AkosBakos — Wed, 02 Oct 2024 09:14:06 GMT

Thank, but this SK is deleted

https://support.checkpoint.com/results/sk/sk94273

Akos

Re: Remote Access VPN - certificate based login

G_W_Albrecht — Wed, 02 Oct 2024 09:22:46 GMT

Use https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/Updating-User-Sites-with-Update-Configuration-Tool.htm instead. Also see https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/Editing-TTM-File.htm?tocpath=The%20Configuration%20File%7C_____1 and https://support.checkpoint.com/results/sk/sk122574

Re: Remote Access VPN - certificate based login

AkosBakos — Wed, 02 Oct 2024 09:38:18 GMT

Is that possible, the trac.conf doesn't contain that information which relevant for the field selection (DN or UPN) from the user point of view?

Akos

Re: Remote Access VPN - certificate based login

PhoneBoy — Wed, 02 Oct 2024 15:19:38 GMT

The cpmsi_tool is mentioned in https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/Editing-MSI-Package-with-CLI.htm
The tool is also distributed with SmartConsole ( in C:\Program Files (x86)\CheckPoint\SmartConsole\VERSION\PROGRAM\util )