topic Mobile access VPN authentication question in SASE and Remote Access

Mobile access VPN authentication question

Herschel_Liang — Tue, 14 Apr 2020 03:46:57 GMT

The client found SNX local user password complexity is low, but it seem that password length can set 8 characters at most. He want to know that is there exist increasing password length/complexity way? Can it be true? If no, 1. budget allow, which MFA way you recommend; 2. no budget, which MFA way you can suggest to increase secure for SNX? How to config?

Re: Mobile access VPN authentication question

PhoneBoy — Tue, 14 Apr 2020 04:19:49 GMT

For local passwords, there is no way to change/increase complexity requirements aside from using "OS Password" authentication: https://community.checkpoint.com/t5/General-Topics/Supporting-more-Complex-Passwords-without-using-a-RADIUS-TACACS/m-p/30099
Then you can leverage Gaia's password length/complexity requirements.

External authentication servers would need to be leveraged for any sort of MFA.
One option is Google Authenticator, which can be set up with FreeRADIUS on any Linux server.
Here's a writeup on how to set that up: https://community.checkpoint.com/t5/General-Topics/MFA-with-Google-Authenticator/m-p/39456#M8416

Most of the other "paid" MFA options would also integrate via RADIUS.
Okta and Duo are two options I've seen write-ups on.

Re: Mobile access VPN authentication question

Herschel_Liang — Tue, 14 Apr 2020 07:22:10 GMT

Test successfully. Very nice.