topic Re: Checkpoint VPN MFA in SASE and Remote Access

Checkpoint VPN MFA

bcmario — Mon, 23 Jun 2025 10:03:33 GMT

Checkpoint VPN 2 factor authentication has been setup successfully, but now there is a requirement where the MFA (multi factor authentication) needs to be enforced on certain users and NOT all users.

Ex : - If there are 10 users, 8 of them will be enforced with MFA and the other 2 will not be enforced with MFA.

Is this possible?

Re: Checkpoint VPN MFA

the_rock — Mon, 23 Jun 2025 10:13:39 GMT

From what Im aware of, its not possible. I asked this exact question while via TAC case and they responded saying escalation team told them it was not feasible. This was back in 2023, but I have not heard otherwise since.

The only way I can see this working would be if you create local users in smart console and assign them specific auth method.

Maybe someone else can confirm.

Andy

Re: Checkpoint VPN MFA

bcmario — Wed, 25 Jun 2025 03:30:39 GMT

@PhoneBoy any idea whether this is still not possible or is there a workaround this now?

Re: Checkpoint VPN MFA

Ruan_Kotze — Wed, 25 Jun 2025 05:48:18 GMT

Not sure if this classifies as a workaround but we managed to accomplish this. The catch is we're doing it through MS Authenticator via Entra Conditional Access Policies.

Re: Checkpoint VPN MFA

garrod — Wed, 25 Jun 2025 05:57:01 GMT

Hi,

I believe this depends on how you setup the MFA as what I understand as well, make sure to untick legacy authentication method. Let me know if it works

Re: Checkpoint VPN MFA

the_rock — Wed, 25 Jun 2025 10:13:21 GMT

How did you set up auth methods in smart console gateway object?

Andy

Re: Checkpoint VPN MFA

Gaurav_Pandya — Wed, 25 Jun 2025 11:35:30 GMT

Hi,

It depends on how you configure IDP. For example, Microsoft azure AD is your IDP then you can enforce 2FA setting in Azure AD. Firewall just forward request to azure AD and it will decide whether to enforce 2FA or not.

Re: Checkpoint VPN MFA

the_rock — Wed, 25 Jun 2025 11:46:15 GMT

Right, but thats generally how it works, not to exclude few users though.

Andy

Re: Checkpoint VPN MFA

PhoneBoy — Wed, 25 Jun 2025 20:58:53 GMT

As far as I know the situation with this has not changed.
Recommend engaging your local Check Point office on this requirement.