topic Re: Remote access MFA only work for users part of the Radius server domain in SASE and Remote Access

Remote access MFA only work for users part of the Radius server domain

Khay — Tue, 03 Jan 2023 14:06:11 GMT

Hello,

I have a NPS server with plugin for Azure AD MFA, this server is part of domain fr.xxx.lan

when a user part of fr.xxx.lan domain use the vpn client to connect, it work as exprected.

when another user (test-be) part of be.xxx.lan try to connect it fail the (user unknow)

If i check the NPS log I can see the SAM-Account-Name and Fully-Qualifed-User-Name with FR\test-be

I understand that the vpn client didnt send the domain information and the radius "fill the blank" with is own domain

Actually I can't authenticate (standard or radius authentication) with username@domain

Is there a way to do so ?

Is this the way to solve my issue ?

Thansk for you help

Re: Remote access MFA only work for users part of the Radius server domain

Chris_Atkinson — Tue, 03 Jan 2023 15:23:08 GMT

Two suggestions to investigate further in consultation with TAC where required.

1. sk122477

2. R81.10 JHF T79:

PRJ-38144,PRHF-22814

Security Gateway

UPDATE: Added support for RADIUS UPN authentication with MS-CHAPv2. To use it, enable the registry configuration in ckp_regedit -a SOFTWARE/Checkpoint/VPN1 RADIUS_MSCHAPV2_UPN -n 1.

Re: Remote access MFA only work for users part of the Radius server domain

Khay — Fri, 06 Jan 2023 08:29:47 GMT

Thanks Chris,

I tried to apply sk122477 with no succes, I think I need to specify the user's domain on the vpn client and for now i'm not able to do it.

I have contacted my local support and will update this post when I get more information.

Re: Remote access MFA only work for users part of the Radius server domain

Duane_Toler — Mon, 09 Jan 2023 14:46:05 GMT

You can check a few other areas, depending on your configuration:

1. Check your LDAP AU object to see what is the "domain name" in the configuration. This is used to verify usernames in the directory.

2. If you are using the newer Multiple Login Options on your gateway, check gateway properties -> VPN Clients -> Authentication and edit the login option being used. In the User Directory section on the left, check what LDAP AU is being used as well as the user lookup value (sAMAccountName, userPrincipleName, etc.).

I have a customer with NPS and Azure AD/MFA plugin. They have to use the UPN to login (test-be@be.xxx.lan in your example) and I also enabled UPN as the lookup method (as I noted in #2 above). However, this depends on the LDAP AU domain name, too. With Azure AD/MFA plugin, *ALL* requests are immediately forwarded to Azure AD from the NPS server (this is an Azure AD plugin requirement, which I learned the hard way). From the implementation I helped configure, this required the UPN name and is dependent on the Azure AD directory.

You can see further RADIUS lookup details with a vpn debug. I would suggest you do this, too.

Re: Remote access MFA only work for users part of the Radius server domain

Khay — Wed, 11 Jan 2023 07:50:52 GMT

Thanks Duane,

you were right its working when I set the UPN setting and use it to login

Thanks a lot 🙂