topic Re: Pros and Cons of different 2fa methods for Remote Access VPN in SASE and Remote Access

Pros and Cons of different 2fa methods for Remote Access VPN

Konstantinos_In — Tue, 13 Nov 2018 16:45:22 GMT

Hello

I need your feedback about the below thread.

Pros and Cons of different 2fa methods for Remote Access VPN for R80.20.

Option1

User Certificate+Domain username password with SNX

Option2

Domain username password + DynamicID (E-mail method) or SecureID with Remote Access VPN client

BR,
Kostas

Re: Pros and Cons of different 2fa methods for Remote Access VPN

G_W_Albrecht — Wed, 14 Nov 2018 09:00:07 GMT

Where is the thread below you want feedback to ? Besides, SNX and RA VPN client are two very different RA solutions, see for differences sk67820: Check Point Remote Access Solutions !

Re: Pros and Cons of different 2fa methods for Remote Access VPN

Konstantinos_In — Thu, 15 Nov 2018 08:08:03 GMT

Hello

It would be interesting to compare 2FA between SNX and Remote Access VPN with client.

BR,

Kostas

Re: Pros and Cons of different 2fa methods for Remote Access VPN

G_W_Albrecht — Thu, 15 Nov 2018 11:34:51 GMT

It would be more interesting to compare the customers needs to SNX and RA VPN capabilities, as 2FA is supported by both...

Re: Pros and Cons of different 2fa methods for Remote Access VPN

Konstantinos_In — Thu, 22 Nov 2018 19:46:14 GMT

Hello Gunther

The needs are

1)only corporate laptop joined on the domain must be able to connect

2)most secure multifactor combination

3)less user disruption

4)end users are not administrators on their laptops

5)network vpn access must be the same when laptops are connected on the internal Network

Thank you

Kostas

Re: Pros and Cons of different 2fa methods for Remote Access VPN

Maarten_Sjouw — Thu, 22 Nov 2018 22:23:14 GMT

RA VPN client with Check Point VPN client certificate and AD account/PW (with cache) is a sure thing to work properly, this will also work when you need to use secondary connect.

Tokens as 2fa will never work with secondary connect as there is nothing to be able to cache and you will get a challenge for each other GW the secondary connect tries to contact. We had a case were there were multiple AD servers scattered throughout the network and the client was connecting to all 8 of them, asking the user 8 times for a challenge...