topic Re: VPN - Integrate certificate + SCV + AzureMFA in SASE and Remote Access

VPN - Integrate certificate + SCV + AzureMFA

Gonza1 — Tue, 30 Aug 2022 14:09:43 GMT

Hello guys,

I´m pretty new with Checkpoint. I´m working with a customer that needs to accomplish the following:

Steps:

1- VPN authentication through certificate.

2- Client "lands" into a zone where SCV is performed.

3- If SCV is successfull then, authenticates with AzureMFA.

As I could see from Kbs, SAML/IDP authentication is not compatible with anything else on same login option, so here comes my concern if the above is doable.

Also, I could not find any docs where it states the vpn process steps. Is there something as such? Something like "first happens this", then this and so on...

Thanks in advance for your time and help.

Regards,

Re: VPN - Integrate certificate + SCV + AzureMFA

PhoneBoy — Tue, 30 Aug 2022 23:02:32 GMT

SCV is performed on the client side once the user has authenticated to the VPN successfully.
If the client fails the SCV check they will still remain connected but will only be allowed to communicate with the configured remediation networks.

Configuring certificate based authentication and SAML together in the Check Point configuration is not supported.
Review the fourth bullet point below from: https://downloads.checkpoint.com/dc/download.htm?ID=114551

That said, if AzureAD (or whatever you're using for SAML authentication) supports the desired authentication methods in the desired order, they can be configured there.

Re: VPN - Integrate certificate + SCV + AzureMFA

Gonza1 — Wed, 31 Aug 2022 09:22:46 GMT

Hi, thanks for the prompt answer. Much appreciated.

Given this case, would it be possible to configure certificate base authentication for VPN and then use SAML MFA within an authentication rule?

Thank you.

Regards,

Re: VPN - Integrate certificate + SCV + AzureMFA

PhoneBoy — Thu, 01 Sep 2022 23:57:31 GMT

Authentication via Remote Access is generally considered sufficient for Identity Awareness purposes.
However, it's not enabled as an Identity Source by default for Identity Awareness.
So...might work? Don't know for sure.