topic Check Point Remote Access Integration with Azure AD MFA in SASE and Remote Access

Check Point Remote Access Integration with Azure AD MFA

Patrickc — Wed, 13 Nov 2024 14:02:26 GMT

HI All,

The customer currently has a requirement for two-step verification when connecting through Endpoint Security VPN. The first step requires entering the on-premises AD username and password, and the second step involves integrating Azure AD's MFA, using Microsoft Authenticator to enter a token. Is this achievable?

GW:R81.20

Thanks

Re: Check Point Remote Access Integration with Azure AD MFA

George_Casper — Wed, 13 Nov 2024 15:35:09 GMT

Do you have sync enabled between on-prem AD and Azure AD?

Re: Check Point Remote Access Integration with Azure AD MFA

Patrickc — Wed, 13 Nov 2024 15:44:34 GMT

Hi George，

Yes

Re: Check Point Remote Access Integration with Azure AD MFA

the_rock — Wed, 13 Nov 2024 15:45:17 GMT

Maybe this guide would help?

Andy

Re: Check Point Remote Access Integration with Azure AD MFA

George_Casper — Wed, 13 Nov 2024 15:51:24 GMT

So long as users and passwords are sync'd you can configure SAML auth directly to Azure AD. There are two ways to hit Azure AD, one directly with SAML, the other with standing up a RADIUS server in the middle. We chose the SAML method, less moving parts. Depending on your M365 license levels you can add also on conditional access policies.

Re: Check Point Remote Access Integration with Azure AD MFA

Patrickc — Wed, 13 Nov 2024 15:51:57 GMT

Hi Rock，

Can I use Check Point without the NPS Extension for Azure MFA? Is it possible to integrate using Check Point’s IDP object via SAML?

Re: Check Point Remote Access Integration with Azure AD MFA

the_rock — Wed, 13 Nov 2024 15:52:50 GMT

I think so.

Re: Check Point Remote Access Integration with Azure AD MFA

Patrickc — Wed, 13 Nov 2024 15:55:04 GMT

Hi George,

I want to use SAML for authentication. Could you please provide the setup method and steps?

Re: Check Point Remote Access Integration with Azure AD MFA

George_Casper — Wed, 13 Nov 2024 15:57:03 GMT

We went with SAML as mentioned above, less moving parts. Though I've read here on previous posts there may be a couple Checkpoint SMB models that may not support SAML depending on what you have.

Re: Check Point Remote Access Integration with Azure AD MFA

Patrickc — Wed, 13 Nov 2024 16:02:30 GMT

Hi George,

I am using the Check Point 3800 appliance, not the Check Point SMB

Re: Check Point Remote Access Integration with Azure AD MFA

George_Casper — Wed, 13 Nov 2024 16:03:16 GMT

See sk172909 for SAML config though I think there's a better SK if I remember gave better step by step instructions.

https://support.checkpoint.com/results/sk/sk172909

Re: Check Point Remote Access Integration with Azure AD MFA

the_rock — Wed, 13 Nov 2024 16:07:41 GMT

Thats it.