topic Re: Checkpoint VPN with Microsoft 2-Factor Authentication in SASE and Remote Access

Checkpoint VPN with Microsoft 2-Factor Authentication

Rodrigo_Silva — Wed, 11 Dec 2019 17:43:25 GMT

Hello everyone

I would like to share with you how I managed to get VPN users to use Microsoft Azure Multi-Factor Authentication.

I saw in some posts that this was possible by using MFA Server, but Microsoft stopped offering MFA Server on July 1, 2019.

What I needed to do:

1 - Office 365 users with MFA enabled.

2 - Dedicated NPS Server.
All Radius requests made to this server will have MFA directed to Microsoft.

3 - NPS extension for Azure MFA
This extension will direct your MFA requests to Microsoft.
You can find the installation and download instructions at the link below.

https://docs.microsoft.com/pt-br/azure/active-directory/authentication/howto-mfa-nps-extension#sync-domain-users-to-the-cloud

The user can define which method will be used in the Microsoft portal.

I tested the methods below on VPN Clients, Mobile Access and Capsule Workspace and they all worked perfectly.

- Notification through mobile app
- Verification code from mobile app
- Text message to phone

I hope this post helps you

Good luck

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

Martins — Wed, 11 Dec 2019 17:37:46 GMT

Excellent!!!! Thank you for share.

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

Ave_Joe — Wed, 11 Dec 2019 20:52:47 GMT

Thanks for sharing.

Was any testing completed with 'Secondary Connect' in this configuration?

Just curious how it worked if tested.

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

Rodrigo_Silva — Wed, 11 Dec 2019 21:04:43 GMT

We currently use the Dynamic ID.
I created a new profile for testing Microsoft MFA.
When the user will connect he can choose which one to use.
After the tests we will keep only one.

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

Konstantinos_In — Thu, 12 Dec 2019 07:52:19 GMT

Hello Rodrigo

As concerns Management server configuration for 2FA, can you please share it with us?

BR,

Kostas

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

Rodrigo_Silva — Thu, 12 Dec 2019 13:51:49 GMT

You need to direct authentication to the Radius server.

You will need a Radius server with NPS extension for Azure MFA installed.

Remember that all requests to this Radius server will have MFA requests.

This setting is the same for Mobile Access.

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

PhoneBoy — Thu, 12 Dec 2019 18:05:46 GMT

Thanks for sharing this.
Moving it to the Remote Access space.

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

Jason_Dance — Mon, 16 Dec 2019 17:31:55 GMT

You may need to extend the RADIUS timeouts to allow for slower RADIUS responses because the end user needs extra time to satisfy the MFA response. SK112933 covers the configuration changes needed on the Management server, including the trac_client_1.ttm file used by the Endpoint suite clients.

Note that if you need to change the trac_client_1 file, you can set it in fwrl.conf to push it from management onto the gateways each time a policy is installed. Let me know if you need the specifics and I'll drop it into this post.

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

jcavet — Mon, 20 Jan 2020 18:54:07 GMT

Great info Rodrigo, did you have to do any specific configuration on the NPS server outside of getting the extension?

I've gotten a new AU configured with using Radius and cannot get a prompt for an MFA code.

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

Pedro_Silva — Tue, 28 Jan 2020 03:19:06 GMT

Make sure you don't have any punctuation or special characters in your Radius Shared Secret.

A single ' caused my configuration to break. The NPS server was authenticating the user but then failing to pass the information back to the gateway.

My working configuration is:

RADIUS server object in Checkpoint Smart Console - configured for Radius Version 2.0 and MS_CHAP2

NPS server with Network Policy to Grant Access to AD User groups using matching Authentication Method.

On NPS Server you can see the authentication events in Event Viewer under Custom Views\Server Roles\Network Policy and Access Services

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

Rodrigo_Silva — Tue, 28 Jan 2020 13:28:53 GMT

Everything I needed to configure the NPS server I found on the link https://docs.microsoft.com/pt-br/azure/active-directory/authentication/howto-mfa-nps-extension#sync-domain-users-to-the-cloud

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

Chris_Atkinson — Wed, 12 Feb 2020 13:01:31 GMT

Very helpful, thanks for sharing!

(Refer also sk114263)

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

anstelios — Fri, 14 Feb 2020 14:07:38 GMT

Configuring an External User Profile (generic*) with Radius authentication on SmartDashboard is still needed for this, right??

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

Tux234 — Fri, 14 Feb 2020 15:04:46 GMT

Thanks for the documentation, could you say what you did on CheckPoint's side to make this work. We have been struggling the last few weeks to make this work, and haven't made any headway. I've configured the RADIUS server with the NPS extension, and we've setup RADIUS authentication on the gateway, but we keep getting a username/password error. Is there another way to set this up that will allow it to work? Would you mind sharing what your working setup looks like? We've been banging our head against the wall the last few weeks, and as you can tell it's starting to show. Appreciate any help that you can give.

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

anstelios — Mon, 17 Feb 2020 15:40:12 GMT

We cant get mobile app notification method to work!

Verification code and SMS to phone work fine!

Any ideas?

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

AZ-Joe — Mon, 17 Feb 2020 19:41:37 GMT

Can you post steps for configuring for SMS to phone or Verification code? I've been struggling to get this to work at all!

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

Rodrigo_Silva — Mon, 02 Mar 2020 17:16:24 GMT

It depends on your policy. My configuration allows VPN connection by AD group. Regardless of whether it is per AD user, or per local user, authentication needs to be sent to the radius server.

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

Rodrigo_Silva — Mon, 02 Mar 2020 17:20:02 GMT

I'm sorry for the late reply.
At CheckPoint I just needed to set up a new radius server and direct authentications to it.
You can even put MFA on who will connect to SmartConsole,

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

Rodrigo_Silva — Mon, 02 Mar 2020 17:39:22 GMT

1 - Your company must have at least one free Azure AD account, and your on-premises AD users must be in sync with the cloud.
2 - In the user's guide, on the office 365 portal, there is the option to manage the double factor of authentication. There you enable the double factor for each user.
3 - The user needs to access the portal.office.com website and complete the configuration.
I don't know if that was your question.
Hope this helps.

Re: Checkpoint VPN with Microsoft 2-Factor Authentication

Rodrigo_Silva — Mon, 02 Mar 2020 17:42:22 GMT

Check if you are having problems with HTTPS Inspection.
In our case it only worked on the 3G network. Then I found out that it was URL inspection.
Now everything works great.