MFA Azure disabling Capsule

rapsodiaverde — Mon, 18 Jul 2022 12:37:06 GMT

Hello,

I configured MFA with Azure on a customer network to be able to authenticate VPN connections from the remote users.

As I know, there is no option to configure Capsule VPN with MFA Azure, so I decided to disable Capsule as a method in the VPN settings and only allow Endpoint Security to enforce users to only use Azure MFA.

But there's is 1 device from the CEO (an IPAD) that it's mandatory that can be able to connect to the VPN.

So there is a way to enable Capsule but only 1 user or 1 device be able to authenticate?
Or exists some method to integrate Capsule with MFA Azure?

The only solution that I found is to deactivate all methods except Endpoint Security and Capsule for IOS.

Thank you

Re: MFA Azure disabling Capsule

PhoneBoy — Fri, 22 Jul 2022 19:58:43 GMT

I assume you mean MFA with Azure AD.
This is currently not supported on Capsule Connect for iOS.

While you cannot prevent any user from authenticating to the VPN with Capsule Connect, you can prevent users who do authenticate from actually connecting to anything.
This ultimately involves creating two Access Roles:

One for the CEO (only) connecting via Capsule Connect
One for everyone else connecting via Capsule Connect

In your rulebase, you'll end up creating two rules: One that allows the CEO to connect to the relevant resources, and another that denies all access from other users.
See the following on creating Access Roles: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_IdentityAwareness_AdminGuide/Topics-IDAG/Introduction-Access-Role-Objects.htm?tocpath=Introduction%20to%20Identity%20Awareness%7C_____1

Note that you will need to enable Identity Awareness if it's not enabled already and enable Remote Access as one of the Identity Sources (not enabled by default).

topic MFA Azure disabling Capsule in SASE and Remote Access

MFA Azure disabling Capsule

Re: MFA Azure disabling Capsule