topic Re: Endpoint VPN MFA client for Linux in SASE and Remote Access

Endpoint VPN MFA client for Linux

abautu — Sun, 24 Apr 2022 03:58:54 GMT

Hello,

I use Checkpoint Endpoint VPN client for Windows and Mac to access a company VPN, using username/password and then confirmation on the phone using Microsoft authenticator. Is there any way to setup a client in this scenario for Linux (Ubuntu)?

Thank you!

Re: Endpoint VPN MFA client for Linux

PhoneBoy — Mon, 25 Apr 2022 01:59:17 GMT

On Linux, the only supported client is SNX, and I believe you can use the Mobile Access portal to perform the required authentication.

Re: Endpoint VPN MFA client for Linux

G_W_Albrecht — Mon, 25 Apr 2022 06:40:35 GMT

If your GW is R81 or higher, you can use sk165014: Supporting strongSwan as a Remote Access client !

Re: Endpoint VPN MFA client for Linux

abautu — Mon, 25 Apr 2022 07:07:46 GMT

@PhoneBoy Thank you. I read in other posts that SNX client is not working with recent Ubuntu versions, nor with MFA. I don't know really is what is. From what I read on this site, it is something that the Endpoint admin has to setup, but unfortunatelly I doubt they will do it.

@G_W_Albrecht Thank you for your reply. It's R84.30 or newer. I tried to follow and adapt the tutorials of @Soeren_Rothe on this site (on Ubuntu desktops 22.04 and 21.10), but it didn't work for me because I didn't know how to adapt to the differences (Soeren is using pre-shared secret; our server seems to use a certificate).
In the Windows client, I just create a new connection (by entering the host name), confirm the server certificate fingerprint (because its root CA is self-signed) and then it's ready to use (I just enter username/password and confirm in Authenticator App).
By reading the Windows client extended logs, I saw that our config uses username+password authentication, but I didn't find info about the server certificate (I do have the root CA certificate).

Re: Endpoint VPN MFA client for Linux

G_W_Albrecht — Mon, 25 Apr 2022 09:11:25 GMT

It's R84.30 or newer. --> I mean the Gateway you connect to must be at least R81 to use strongSwan.

Re: Endpoint VPN MFA client for Linux

abautu — Mon, 25 Apr 2022 09:19:19 GMT

Thank you for you quick reply. How can I check what version is my Gateway?

Re: Endpoint VPN MFA client for Linux

G_W_Albrecht — Mon, 25 Apr 2022 09:27:02 GMT

That depends on your level of access:

- ask the FW admin

- connect to GWs GAiA portal, you do not need to login

- start SmartDashboard and look at the GW version

- connect to GW using SSH and issue # fw ver

Re: Endpoint VPN MFA client for Linux

PhoneBoy — Mon, 25 Apr 2022 14:44:22 GMT

There is nothing you can do as an end user to enable Remote Access via a Linux system.
You will need to work with your admins directly on this.

Re: Endpoint VPN MFA client for Linux

abautu — Mon, 25 Apr 2022 18:54:13 GMT

Thank you both for your replies. I wasted too much time (about 7-8 day already) trying to get this working so I'll stick to Windows for now. As another user pointed out in a different thread, It's a pitty that Checkpoint doesn't support Linux for real (I'm not talking about SNX). Many other vendors do so.

Re: Endpoint VPN MFA client for Linux

tomwitt2 — Tue, 10 May 2022 15:25:24 GMT

Couldn't agree more. As a developer on Linux, I've suffered for multiple years trying to access our checkpoint system, having to use an old an insecure version of SNX to connect. Once we went to 2FA, IT had to setup an AWS entrypoint since Checkpoint no longer worked for me.

Checkpoint uses Linux but doesn't provide a Linux client. Shameful.

Re: Endpoint VPN MFA client for Linux

lmazzufferi — Fri, 08 Sep 2023 08:29:33 GMT

hi there,

is there any update regarding support for linux users for VPN MFA?

Re: Endpoint VPN MFA client for Linux

PhoneBoy — Sat, 09 Sep 2023 02:33:09 GMT

The situation is the same as previously stated.
I recommend engaging with your local Check Point office with this requirement.

Re: Endpoint VPN MFA client for Linux

fb2 — Wed, 13 Sep 2023 12:16:33 GMT

Could you please be some more specific? Maybe give some hints on which are the main configuration elements that admins and user should take into account to make connection from Linux possible?

Re: Endpoint VPN MFA client for Linux

G_W_Albrecht — Wed, 13 Sep 2023 15:22:12 GMT

See VPN Client for Linux

Re: Endpoint VPN MFA client for Linux

PhoneBoy — Wed, 13 Sep 2023 15:23:38 GMT

In order to give more specific details, I would need to know what precisely what versions are involved.
In general, though, there are two clients supported from Linux: SNX and StrongSWAN.

SNX is generally configured as part of Mobile Access Blade.
Refer to the relevant product documentation for your version: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_MobileAccess_AdminGuide/Content/Topics-MABG/Native-Applications-for-Client-Based-Access.htm?tocpath=Mobile%20Access%20Applications%7CNative%20Applications%20for%20Client-Based%20Access%7C_____0#Native_Applications_for_Client-Based_Access
The MAB Deployment Agent is used to deploy/activate SNX from the Mobile Access Portal.
This requires JDK to be installed on client computers.
See also (for requirements): https://support.checkpoint.com/results/sk/sk114267

StrongSWAN requires gateways running R81 and above and specific configuration.
Refer to the product documentation:
https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/strongSwan-Client-Support.htm

Re: Endpoint VPN MFA client for Linux

nguyentthai96 — Sat, 01 Jun 2024 02:57:43 GMT

Can you help me command or GUI line use that tool strongswan? Pls, thank you so much

Re: Endpoint VPN MFA client for Linux

PhoneBoy — Mon, 03 Jun 2024 13:15:24 GMT

In Linux Mint, it's integrated into Network Manager if you load the relevant package: https://community.linuxmint.com/software/view/network-manager-strongswan
I assume other Linux distributions have a similar integration.

Re: Endpoint VPN MFA client for Linux

nguyentthai96 — Mon, 03 Jun 2024 16:59:24 GMT

I had to try research more and config strongswan with UI tools gome
https://community.checkpoint.com/t5/Remote-Access-VPN/strongSwan-GUI-Network-Manager-Username-Password/m-p/182449
but I don't know how to config connect to VPN Checkpoint with 2FA get OTP token from FortiToken, I try more and config l2tp vpn client ubuntu 22.04 but cannot success.

With my config /etc/ipsec.conf

config setup charondebug="ike 2, knl 2, cfg 2" conn %default keyexchange=ikev2 ike=aes256-sha256-modp2048! esp=aes256-sha256! conn myvpn keyexchange=ikev2 leftauth=eap-mschapv2 eap_identity=ACCOUNT_VPN right=IP_SERVER_VPN rightid=%any rightauth=pubkey rightsubnet=0.0.0.0/0 rightdns=8.8.8.8,8.8.4.4 leftsourceip=%config auto=start

Maybe, my config is wrong so search and get by sample.

My team uses the Windows connect from Remote Access VPN

After entering the username/password -> connecting and response -> enters OTP token [Response] get from FortiToken here

My partner talked about configuring Site-to-Site Checkpoint VPN version R81.20, I need a solution client remote to connect on linux (Ubuntu).
Thank you so much, for replying to me. If can please help me.

Re: Endpoint VPN MFA client for Linux

PhoneBoy — Wed, 05 Jun 2024 16:33:48 GMT

The only supported VPN client for Linux is SNX, which is deployed through Mobile Access Blade and should support this authentication flow when logging into the web-based MAB portal (which can activate SNX).
We do not support StrongSWAN with MFA: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/strongSwan-Client-Support.htm

We are planning to release a VPN client for Linux, but it's not in the near term.

Re: Endpoint VPN MFA client for Linux

fb2 — Wed, 05 Jun 2024 16:57:53 GMT

Thank you PhoneBoy.

Last line sound like good news for us Linux users, that have the only option of an old (and luckily working!) SNX to date.

Any hope to know something more about the meaning of "not in the near term"?

best regards