topic Re: SAML Support for Remote Access VPN in SASE and Remote Access

SAML Support for Remote Access VPN

Simon_Macpherso — Mon, 20 Mar 2023 02:43:00 GMT

Hello,

When configuring SAML integration for Remote Access VPN, the following documentation specifies Endpoint Security Client for Windows - version E84.70 build 986102705 or higher needs to be installed.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/SAML-Support-for-Remote-Access-VPN.htm?tocpath=_____19

Our Windows users are currently using the Checkpoint Capsule VPN client from the Windows store, which allows users to configure a VPN connection profile with the OS VPN settings.

Can the Checkpoint Capsule VPN client be used for SAML authentication for Windows users instead of deploying Endpoint Security Client for Windows - version E84.70 build 986102705 or higher to each machine?

Regards,
Simon

Re: SAML Support for Remote Access VPN

Simon_Macpherso — Mon, 20 Mar 2023 04:43:40 GMT

Found sk177646 which is related

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk177646&partition=Advanced&product=Capsule

Re: SAML Support for Remote Access VPN

_Val_ — Mon, 20 Mar 2023 06:34:37 GMT

Look here: https://support.checkpoint.com/results/sk/sk172909

Capsule is not listed, which means SAML is not supported with it.

Re: SAML Support for Remote Access VPN

PhoneBoy — Tue, 21 Mar 2023 02:08:42 GMT

Capsule VPN clients on any platform (Windows, iOS, Android) do not currently support SAML authentication.

Re: SAML Support for Remote Access VPN

ClaudiaPeter — Wed, 12 Apr 2023 10:05:30 GMT

Is there any roadmap for SAML support for iOS clients?

SAML is supported for Windows clients since nearly 2 years, but for iOS clients it is still "not currently supported". To use different authentication methods during a transition time period is okay, but after two years and with no chance to solve this, we are urged to migrate to another VPN solution.

Re: SAML Support for Remote Access VPN

PhoneBoy — Wed, 12 Apr 2023 17:15:56 GMT

Recommend you engage with your Check Point SE on this requirement.

Re: SAML Support for Remote Access VPN

SenpaiNoticed_U — Fri, 15 Sep 2023 18:50:08 GMT

SK172909 states at the top, that SAML is not supported with

Capsule VPN / Capsule Connect / Capsule for Windows

Re: SAML Support for Remote Access VPN

Chris_Atkinson — Sun, 17 Sep 2023 10:46:03 GMT

There has been progress in recent Jumbo's it seems: R81.10 JHF T113

PRJ-47677,PMTR-88036 - VPN - UPDATE: Added SAML authentication support for Capsule Connect / Capsule VPN.

Re: SAML Support for Remote Access VPN

SenpaiNoticed_U — Sun, 17 Sep 2023 21:24:01 GMT

Not seeing any Official Admin Guide nor an SK article. This may still be in development.
just that the Jumbo for R81.10 JHF Take_113 may have included the feature to be released, like how in R80.40 JHF Take_114

Re: SAML Support for Remote Access VPN

PhoneBoy — Mon, 18 Sep 2023 13:19:04 GMT

While I agree this is positive movement, I assume this would also require client updates as well.

Re: SAML Support for Remote Access VPN

SenpaiNoticed_U — Mon, 18 Sep 2023 14:23:05 GMT

No ETA on the feature release, but I would assume its more in align with when Jumbo release schedules are pushed out.
But at current state, Capsule is not yet fully supported with SAML.

Re: SAML Support for Remote Access VPN

Sam2 — Wed, 25 Oct 2023 17:03:53 GMT

I have this working in my lab and we will be looking to roll it out into production later this year for our mobile clients. I patched the gateway to R81.10 Jumbo 113 and enabled the SAML auth profile on the VPN Clients section.

Initially I got a white page only when attempting to connect. After collecting debugs from my phone it was related to a certificate issue. Worked with my cert people to get a new public certificate that included my lab gateways hostname and i was able to get redirected to azure AD on connection for sign in, and i connected to the VPN after successfully logging in.

Below is the debug from Capsule VPN Android that showed me my cert wasn't trusted and it was causing the issue:

* This can be ignored when using the Endpoint VPN solution (for lab) but it doesn't give an option to approve an untrusted cert on mobile.

Re: SAML Support for Remote Access VPN

SenpaiNoticed_U — Wed, 25 Oct 2023 20:25:43 GMT

SK172909
Capsule VPN for Android and Iphone are not supported for SAML auth at this time.

Re: SAML Support for Remote Access VPN

gsciotti — Thu, 26 Oct 2023 12:50:38 GMT

Hi Chris,

good news. Do you have any documentation about how to implement it? Does it just work updating to the jhf 113 if actually SAML is used on PC/MAC devices?

Re: SAML Support for Remote Access VPN

Chris_Atkinson — Thu, 26 Oct 2023 13:38:01 GMT

This is the gateway portion, likely a future client version is also needed to complete the picture at which time the documentation will be updated / made available.

Re: SAML Support for Remote Access VPN

Peter_Lyndley — Wed, 01 Nov 2023 13:55:12 GMT

Someone must know if the updated client for SAML support is in the pipeline though ? Do we at least know if it is due before end 2023 ?

Re: SAML Support for Remote Access VPN

Sam2 — Wed, 01 Nov 2023 14:21:46 GMT

Working with my sales team the fix owner says it is supported, we already have it working on mobile now.

Re: SAML Support for Remote Access VPN

SenpaiNoticed_U — Wed, 01 Nov 2023 14:25:30 GMT

I know there is something in the works, but I have not been informed of any ETA or related data for it.
Once It is fully supported, I will know and the SK will be released.

Re: SAML Support for Remote Access VPN

PhoneBoy — Wed, 01 Nov 2023 18:27:49 GMT

If you're working with your local Check Point office on this, it's very likely this is considered a "customer release" at present.
Given that it's rolled out to a public JHF, it's a good indication this will be formally supported in the near future.

Re: SAML Support for Remote Access VPN

ClaudiaPeter — Fri, 05 Jan 2024 09:03:55 GMT

Is there any new information when it will be formally supported?

We tested it and it works, we need it badly, but we will not rollout a unsupported solution.