topic Re: Remote Access Vpn SMB two factor autenthication in SASE and Remote Access

Remote Access Vpn SMB two factor autenthication

Bac26 — Thu, 23 Mar 2023 14:55:34 GMT

Hello

Is it possible to use Microsoft Authenticator as second factor for Remote VPN access to SMB series centrally managed via Smart-1 Cloud

Any guide can refer too?

Thank you

Re: Remote Access Vpn SMB two factor autenthication

Chris_Atkinson — Thu, 23 Mar 2023 15:32:00 GMT

Believe this is currently a limitation, refer: sk178604

Will check if it's planned to be resolved in the next release and revert.

Re: Remote Access Vpn SMB two factor autenthication

Bac26 — Thu, 23 Mar 2023 15:41:50 GMT

so kind MFA can you use? any suggestion?

Re: Remote Access Vpn SMB two factor autenthication

Chris_Atkinson — Thu, 23 Mar 2023 15:44:51 GMT

Anything Radius based would likely work here. Possibly a integration via Microsoft NPS as an intermediary?

Recommended R81.10.x in this case so you have access to Radius 2.0

Re: Remote Access Vpn SMB two factor autenthication

Bac26 — Thu, 23 Mar 2023 15:57:34 GMT

Hello

are you sure as they show me those limitation

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk178604&partition=Basic&product=Quantum

Re: Remote Access Vpn SMB two factor autenthication

Chris_Atkinson — Thu, 23 Mar 2023 23:53:43 GMT

Radius is a workaround and not listed there as a limitation?

Re: Remote Access Vpn SMB two factor autenthication

PhoneBoy — Fri, 24 Mar 2023 01:19:50 GMT

My understanding from talking with R&D is that the latest firmware (R81.10.05) has support for Remote Access SAML integrated.
However, because it has not been tested by QA to confirm it, it is still listed as a known limitation.
Assuming your Smart-1 Cloud tenant is on R81.20, then you should be able to apply the following: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk172909&partition=Advanced&product=Endpoint

Having said that, this isn’t formally supported (yet).
If you want formal support, I recommend engaging with your Check Point SE.

Otherwise, you’re limited to using RADIUS + NPS as @Chris_Atkinson suggested.

Re: Remote Access Vpn SMB two factor autenthication

Bac26 — Fri, 24 Mar 2023 07:27:58 GMT

So beside it not using radius can you use any other multifactor authentication?

Re: Remote Access Vpn SMB two factor autenthication

PhoneBoy — Fri, 24 Mar 2023 19:37:55 GMT

If the gateway was locally managed (not with Smart-1 Cloud) AND you were running the latest release, you could do MFA over Email or SMS.
Otherwise, you’re limited to using RADIUS or maybe TACACS.
Or try the SAML approach and share your feedback 🙂