topic Re: 2FA for ssl VPN in SASE and Remote Access

2FA for ssl VPN

kevin100 — Mon, 12 May 2025 11:29:26 GMT

Hai

One of the client needs to enable 2FA, MFA for ssl vpn checkpoint for 15 users .

Client got on premise AD and no radius server.

Please provide a recommended solution, and what components required for that solution, like radius server

Re: 2FA for ssl VPN

AkosBakos — Mon, 12 May 2025 11:38:00 GMT

Hi, hard situation. Low cost, not so beautiful, but certificate based VPN can be the solution.

Page 40:

Digital User Certificates
Digital Certificates are the most recommended and manageable method for authentication.
Both parties present certificates as a means of proving their identity. Both parties verify that the
peer's certificate is valid (i.e. that it was signed by a known and trusted CA, and that the
certificate has not expired or been revoked).
Digital certificates are issued either by Check Point's Internal Certificate Authority or third-party
PKI solutions. Check Point's ICA is tightly integrated with VPN and is the easiest way to
configure a Remote Access VPN. The ICA can issue certificates both to Security Gateways
(automatically) and to remote users (generated or initiated).
Generate digital certificates easily in SmartConsole > Security Policies > Access Tools >
Client Certificates.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/CP_R81.20_RemoteAccessVPN_AdminGuide.pdf

Re: 2FA for ssl VPN

kevin100 — Mon, 12 May 2025 11:50:34 GMT

Hai thanks for the reply, will Duo 2fa work with checkpoint ssl VPN

Re: 2FA for ssl VPN

AkosBakos — Mon, 12 May 2025 11:53:55 GMT

Hi @kevin100

I thought that you don't want to invest any money.

If yes, the Cisco DUO is the one of the best and cheapest solution for this. I have experience with that, it works, as expected!

Akos

Re: 2FA for ssl VPN

kevin100 — Mon, 12 May 2025 11:57:18 GMT

Dear Akos

Thanks for the info, do this solution setup need a separate radius server?

Also hope checkpoint ssl vpn works with laptops

Thank you

Re: 2FA for ssl VPN

AkosBakos — Mon, 12 May 2025 12:36:32 GMT

Hi @kevin100

A small connector tool is needed for the Cisco DUO. It must be installed locally.

SSL VPN ha browsed dependencies. It should work with laptop, of course,

Akos

Re: 2FA for ssl VPN

the_rock — Mon, 12 May 2025 13:07:37 GMT

Yea, DUO works 100%. I know few customers who use it without any issues.

Andy