topic Re: Checkpoint harmony connect start before logon in SASE and Remote Access

Checkpoint harmony connect start before logon

karthikrajaraj — Tue, 28 Feb 2023 12:20:04 GMT

We are evaluating harmony connect to connect remote users and azure cloud. We are having an Active directory server in Azure cloud. We are able to connect azure resources and connect the remote user to ad successfully through harmony connect network access.

After the AD connection users are unable to use AD credentials as the harmony connect does not start before logon.

Is this feasible with harmony connect or any work around available to achieve this?

Thanks

Karthik

Re: Checkpoint harmony connect start before logon

odedm — Tue, 28 Feb 2023 16:22:50 GMT

Hi Karthik,
Harmony Connect Agent need to identify the current signed in user therefore it does not seem to be feasible to connect before sign in.
Please contact me directly to elaborate on this need.
Thanks,
Oded

Re: Checkpoint harmony connect start before logon

PhoneBoy — Tue, 28 Feb 2023 19:14:39 GMT

I know with our regular VPN client, this is possible using Machine Certificate Authentication.
See: https://community.checkpoint.com/t5/Remote-Access-VPN/How-to-Have-Remote-Access-VPN-Tunnel-Before-User-is-Logged-In/m-p/173047#M8674

Re: Checkpoint harmony connect start before logon

Chris_Atkinson — Tue, 28 Feb 2023 22:06:57 GMT

So to clarify you aren't using Azure AD as your IDP but normal AD hosted in Azure, is ADFS used here?

Re: Checkpoint harmony connect start before logon

karthikrajaraj — Wed, 01 Mar 2023 04:38:27 GMT

Yes. We are using normal AD since we need to configure group policy for end user computers.

Re: Checkpoint harmony connect start before logon

karthikrajaraj — Wed, 01 Mar 2023 04:40:36 GMT

Yes. I understand. I am trying one work around for this problem. I will let you know if it works.

Re: Checkpoint harmony connect start before logon

anstelios — Mon, 17 Apr 2023 14:27:14 GMT

So is machine certificate authentication an option for Harmony Connect?

I strongly believe there should be an option for pre-logon connectivity on Harmony Connect.

Re: Checkpoint harmony connect start before logon

odedm — Mon, 17 Apr 2023 15:12:15 GMT

Harmony Connect needs to identify the logged in user (not the machine).
Theoretically, multiple end users can share the same bare metal machine.
In such case, each end user should be identified, they even can be associated with different accounts in Harmony Connect.
Each identified user can be member of different AD groups (different access rules)