topic Re: Second factor from Radius (MFA) in SASE and Remote Access

Second factor from Radius (MFA)

Ildar07 — Thu, 20 Jun 2024 11:36:09 GMT

Hello.

We have Checkpoint on R77.30. And we want to use multi factor authentication for endpoint VPN clients.

We already have MFA with ASA. MFA based on freeradius with LinOTP. It work fine on ASA: with first factor VPN user input AD credentials and radius check user in AD, and if user is checked radius send challinge response - user see another window. He enter TOTP pin and get authorize.

But when we use same server for checkpoint - it dont work. Second window do not appear. It is looks like checkpoint do not understand "Access-Challenge" from Radius server. This is true?

Re: Second factor from Radius (MFA)

the_rock — Thu, 20 Jun 2024 11:39:48 GMT

R77.30, hope you know its long time not supported. But, lets see if we can help. Can you send some screenshot of the config for this?

Andy

Re: Second factor from Radius (MFA)

Ildar07 — Thu, 20 Jun 2024 11:48:24 GMT

Configurations is very simple. I use Radius server for Authentication VPN Users in VPN settings. And I just want to know: does the checkpoint understand "Access-Challenge" from Radius server?

Re: Second factor from Radius (MFA)

Chris_Atkinson — Thu, 20 Jun 2024 12:06:51 GMT

In some configurations you need to append the password+code together.

Again R77.30 is EOL.

Re: Second factor from Radius (MFA)

the_rock — Thu, 20 Jun 2024 12:23:05 GMT

It does work, I used it before. But again, you are on totally unsupported version, so you would not be able to get any TAC help if needed.

Andy

Re: Second factor from Radius (MFA)

PhoneBoy — Thu, 20 Jun 2024 19:40:24 GMT

If the user enters their password followed by the MFA code in the password field, it should work.
An "Access Challenge" prompt in RADIUS is currently not supported.