topic Re: VPN with MFA push in SASE and Remote Access

VPN with MFA push

petermatuska — Tue, 26 Apr 2022 20:40:56 GMT

Hi,

we are extracting username from user's certificate (without password) and sending it to the RADIUS server - ISE. ISE sends it to Duo MFA in order to send the push notification. When user decides to Deny the notification, the Access-Reject is sent from Duo to ISE and from ISE to Check Point. The problem is that after the first Access Reject the second Access-Request is sent from FW and user has to Deny the push 2 more times and after that the VPN client says Denied access.

Where can this "3 times counter" can be changed so after first Deny the connection is rejected?

thank you

Re: VPN with MFA push

the_rock — Wed, 27 Apr 2022 01:32:57 GMT

There is really no "3 time counter" anywhere that Im aware of...what does the log show on CP when user rejects the notification?

Re: VPN with MFA push

petermatuska — Wed, 27 Apr 2022 05:53:33 GMT

Hi, it says failed log in...I did the wireshark on ISE and CP. Everytime the reject is sent from the ISE, the request is sent from CP.