topic Microsoft CA integration for Remote access vpn users in SASE and Remote Access

Microsoft CA integration for Remote access vpn users

MiniNinja — Mon, 14 Aug 2023 18:14:37 GMT

Good afternoon.
Installed Checkpoint 5400 81.10 with Ipsec VPN blades, mobile access, identity awareness.

The identity collector is deployed and connected to Microsoft AD.

In addition, a Microsoft CA is deployed and its certificate is added to the Trusted CA object.

I can't find step-by-step instructions on how to configure it so that users of remote vpn access can either generate a certificate through the Microsoft CA portal and select it when connecting, or the gateway itself requests a certificate for the user and installs it for connection.

Re: Microsoft CA integration for Remote access vpn users

PhoneBoy — Wed, 30 Aug 2023 00:20:23 GMT

Can't give you the exact steps, but here they are at a high level:

1. Import the relevant CA key into a new Trusted CA object similar to: https://support.checkpoint.com/results/sk/sk149253
2. Configure LDAP for Remote Access with an AD server: https://support.checkpoint.com/results/sk/sk31841

You can specify Certificate as the authentication method in the relevant user template.
As long as the certificate has the same CN as what's in LDAP, you should be good to go.