topic Re: binding ip address with mac address for users in General Topics

binding ip address with mac address for users

medtiti92 — Tue, 24 Dec 2024 08:46:31 GMT

i'am using Checkpoint 9100 with R80.20 as SMS. I would like to assign each user IP address with a mac address. That's mean, if i take a IP address of my neighboor i can't access to network or internet

can we do this in checkpoint ?

Re: binding ip address with mac address for users

PhoneBoy — Tue, 24 Dec 2024 13:58:47 GMT

MAC addresses are not something you can “assign” as they are determined by the hardware the user is using.
We also don’t do any enforcement based on MAC address, therefore no ability to bind a user to a MAC.

Re: binding ip address with mac address for users

the_rock — Tue, 24 Dec 2024 14:22:36 GMT

What type of user exactly?

Andy

Re: binding ip address with mac address for users

medtiti92 — Tue, 24 Dec 2024 15:00:27 GMT

When i said bind ip address with mac address, i mean if the IT department give the ip : 192.168.76.89 to computer_user_1, so i want to bind this ip address with the mac address of the computer computer_user_1.

Some users IP address are able to access some categories of sites, so if someone is absent, some users are able to table their ip address to reach those categories sites ..;

Re: binding ip address with mac address for users

the_rock — Tue, 24 Dec 2024 15:06:00 GMT

The closest thing I can think of would be below.

Andy

Re: binding ip address with mac address for users

medtiti92 — Tue, 24 Dec 2024 15:26:16 GMT

@the_rock thanks for your reply, but it's vpn client for the remoter users. What i want is for the local network.

Re: binding ip address with mac address for users

the_rock — Tue, 24 Dec 2024 15:29:52 GMT

As Phoneboy said, thats not sadly possible, sorry.

Andy

Re: binding ip address with mac address for users

PhoneBoy — Tue, 24 Dec 2024 21:42:18 GMT

A Check Point gateway can do this enforcement irrespective of the IP address with Identity Awareness and App Control/URL Filtering.
That assumes the policy is enforced on a Check Point gateway, of course.

Re: binding ip address with mac address for users

medtiti92 — Tue, 24 Dec 2024 22:14:39 GMT

How can i do that in checkpoint gateway ?

Re: binding ip address with mac address for users

the_rock — Tue, 24 Dec 2024 22:19:26 GMT

Maybe access role? Not sure, let @PhoneBoy confirm.

Re: binding ip address with mac address for users

PhoneBoy — Wed, 25 Dec 2024 01:11:27 GMT

A lot more information about the environment would be necessary to give you specific answers.
In general, though, you need to configure access to the relevant identity sources, create Access Roles, and create the relevant access rules using those Access Roles.
Supported identity sources include:

On-premise Active Directory
Identity Agents (for individual-use PCs and multi-user systems like Terminal Servers)
RADIUS Accounting
Identity Web API
Remote Access
Identity Collector
Captive Portal (supports Kerberos)

More on the above can be found here: https://sc1.checkpoint.com/documents/Identity_Awareness_Clients_Admin_Guide/Content/Topics-IA-Clients-AG/Introduction.htm
See also: https://support.checkpoint.com/results/sk/sk86441

Re: binding ip address with mac address for users

PhoneBoy — Wed, 25 Dec 2024 01:13:25 GMT

See also the podcast I did talking about Identity Awareness Best Practices, the notes for which link to more detailed sessions on the topic: https://community.checkpoint.com/t5/CheckMates-Go-Cyber-Security/S06E08-Identity-Awareness-Best-Practices/ba-p/220330

Re: binding ip address with mac address for users

medtiti92 — Wed, 25 Dec 2024 20:40:35 GMT

Thanks @PhoneBoy for these idea, i will read all of this and hope find solutions.