topic Re: Checkpoint VPN MFA and AD in SASE and Remote Access

Checkpoint VPN MFA and AD

sukruozdemir — Tue, 26 Sep 2023 11:21:08 GMT

Hello,
I am using two 16200 appliance R81.10.
I have several different Active Directory domains.
I can grant VPN authorization to users in these different domains as I wish, using the Username and Password method.
We need to start using MFA on VPN Client and Mobile Access.
I'm considering using Google Authenticator. The documents I read always focus on creating local users on radius.
I want users to be authenticated with Active Directory again and I add Google Authanticator as a + to this process.
Can I do this? Is there a sample document?

Thanks,
Sukru Ozdemir

Re: Checkpoint VPN MFA and AD

PhoneBoy — Tue, 26 Sep 2023 14:27:52 GMT

You don’t need to create local users here.
However, you will need to configure a RADIUS server that will be used to handle Google Authenticator.
You'll have to configure multiple authentication methods for your users: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_RemoteAccessVPN_AdminGuide/Topics-VPNRG/User-and-Client-Authentication.htm

Re: Checkpoint VPN MFA and AD

the_rock — Tue, 26 Sep 2023 15:47:32 GMT

Apart from what legendary Phoneby gave you, I also attached some docs that are hopefully useful.

Andy