topic Re: Remote Access VPN client for Linux that support 2FA in SASE and Remote Access

Remote Access VPN client for Linux that support 2FA

Peter_Kenda1 — Mon, 27 Nov 2023 06:28:41 GMT

Dear CheckMates,

I have customer that can only use Linux for operating system. That customer have more offices, but primary work from home. On all the office we have SMB devices, which is locally managed. All the devices run Firmware R81.10.08. This firmware has options for 2FA which work good for Windows and MacOS clients. As I know for Linux OS there no Remote Access VPN clients, but you have two options:

- SNX

- libreSwan

The customer already uses SNX but when I turn on the 2FA this stop working. Is there any options that SNX support 2FA?

From the CheckPoint documentation I know that Two-Factor Authentication is not supported for libreSwan.

From the CheckPoint site I find this Specifications table (attachment) which say that Multi-factor Auth on Linux is supported.

Have any one some experience with RAS VPN Linux client in combination with 2FA/Multi-factor authentication?

Best regards, Peter

Re: Remote Access VPN client for Linux that support 2FA

_Val_ — Mon, 27 Nov 2023 09:19:16 GMT

libreSwan should work with 2FA, did you try it?

Re: Remote Access VPN client for Linux that support 2FA

Peter_Kenda1 — Mon, 27 Nov 2023 09:23:59 GMT

Hi Val,

From the CheckPoint documentation https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_RemoteAccessVPN_AdminGuide/Topics-VPNRG/strongSwan-Client-Support.htm?Highlight=StrongSwan

under the Known Limitations we can see Two-Factor Authentication is not supported.

Best regards, Peter

Re: Remote Access VPN client for Linux that support 2FA

_Val_ — Mon, 27 Nov 2023 09:28:04 GMT

Gotcha, missed that. I suggest you to open a TAC request to see what can be done.

Re: Remote Access VPN client for Linux that support 2FA

Peter_Kenda1 — Mon, 27 Nov 2023 12:02:46 GMT

I do this. The first answer was:

https://support.checkpoint.com/results/sk/sk137732

Then second answer:

https://support.checkpoint.com/results/sk/sk105317

Then I try access to Mobile Access Portal through the browser, but also here I didn't find the field for second auth.

Re: Remote Access VPN client for Linux that support 2FA

_Val_ — Mon, 27 Nov 2023 12:06:19 GMT

Not sure I follow. Can you please elaborate?

Re: Remote Access VPN client for Linux that support 2FA

Peter_Kenda1 — Mon, 27 Nov 2023 12:23:06 GMT

Open the ticket with support. The suggestion was sk137732 - 2FA (Factor Authentication) support for remote access VPN in locally managed SMB appliances.

But we already turn on 2FA and with Windows VPN client work as should. On Linux over the CLI not work and I receive the second sk105317 - Unable to connect with SNX CLI client via Mobile Access Portal with Two Factor Authentication.

But Mobile Access Portal on SMB device? I can chose CheckPoint VPN clients, Mobile client, SSL VPN, Windows VPN client.

First opetion is related to CheckPoint VPN aplication, Second option is related only for Mobile devices (Androdi and iOS), third is for SNX and last again for windows environment.

Re: Remote Access VPN client for Linux that support 2FA

PhoneBoy — Mon, 27 Nov 2023 16:00:23 GMT

The MAB Portal is not supported on SMB appliances.
Which means it cannot be used to prompt for the second factor.
This is probably an RFE (Request for Enhancement) and would need to be addressed through your local Check Point office.

Re: Remote Access VPN client for Linux that support 2FA

QuienSabe — Fri, 19 Apr 2024 10:37:36 GMT

Hi,

Is there any news on this issue?

I see several requests to get a Linux Client to connect to CheckPoint and also some that request 2FA in such a client but I always just see the standard answer "no, it is not supported". That's quite disappointing, especially with requests again and again that just seem to be ignored. Isn't CheckPoint interested in supporting people who use Linux at all?

Re: Remote Access VPN client for Linux that support 2FA

PhoneBoy — Fri, 19 Apr 2024 13:35:47 GMT

We are continuing to enhance Harmony Endpoint on Linux and I believe a proper VPN client is planned as part of that.
No ETA, though.

If you need something for Linux today, I recommend checking out Harmony SASE, which has a VPN client for Linux: https://support.perimeter81.com/docs/linux-agent-release-notes

Re: Remote Access VPN client for Linux that support 2FA

QuienSabe — Fri, 19 Apr 2024 15:35:02 GMT

That sounds good. I hope it will include 2FA when it arrives.

The problem with checking out something else is that it is hard for most who need a client to convince their employers to switch to a different solution because some of the employees finally want to get rid of Windows.