topic Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security) in SASE and Remote Access

MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

Sanjay_S — Tue, 20 Jul 2021 08:59:53 GMT

Hi All,

Currently users are authenticating with Secure Envoy MFA and we are planning to move out of SecureEnvoy and use Azure MFA for the Mobile Access blade Client based VPN. May i know what all should be considered here for this change and as per my knowledge in Azure we use SAML authentication for MFA. So does our Checkpoint supports it? If yes, can you please share me any relavent docs that helps me in configuring it, as i did not find one.

Regards,

Sanjay S

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

PhoneBoy — Tue, 20 Jul 2021 20:25:14 GMT

Only supported on R80.40 with a recent JHF.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk172909&partition=Advanced&product=Endpoint

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

Sanjay_S — Thu, 22 Jul 2021 10:02:53 GMT

Thanks a lot PhoneBoy. This really helps.

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

Sanjay_S — Mon, 26 Jul 2021 12:14:18 GMT

Hi PhoneBoy,

Can i configure 2 servers simultaneously for authentication?

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

PhoneBoy — Mon, 26 Jul 2021 17:27:45 GMT

Given how SAML authentication works, don't believe that's possible.
For RADIUS, you can definitely do this (using a RADIUS Group object).

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

Sanjay_S — Wed, 15 Sep 2021 13:46:08 GMT

Hi All,

Is there any document that helps me in implementing the Azure SAML authentication for Mobile Access Remote Access VPN clients.

We need to remove the legacy Radius Authentication and put in SAML authentication in place without impact. So please suggest the best way.

Regards,

Sanjay S

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

PhoneBoy — Wed, 15 Sep 2021 15:34:44 GMT

Mobile Access has supported SAML authentication since R80.40 for the portal itself.
For the SNX client, you must use the Unified Policy mode as described here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170775&partition=Advanced&product=Mobile
For other remote access clients, https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk172909

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

Sanjay_S — Mon, 20 Sep 2021 09:10:59 GMT

Thank you Phone Boy:)

Configuring the Intune complaince is compulsion for SAML Authentication?

Also if we have the Checkpoint Self-Signed certificate cant we get this working?

Regards,

Sanjay S

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

PhoneBoy — Mon, 20 Sep 2021 20:46:33 GMT

I don't believe Intune is required here, but it can be used if desired.
As far as the SAML authentication piece goes, I don't believe the self-signed certificate is relevant to the flow.

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

Sanjay_S — Wed, 22 Sep 2021 13:36:57 GMT

Hi PhoneBoy,

We have enabled Identity Awareness blade as well. Do we need to consider any changes to integrate while we setup SAML authentication? I have went through the configuration videos from the Youtube link that was updated in the SK. And now i have bit confidence on what to do, but just wanted to understand is there any config that needs to be considered for Identity Awareness Blade?

regards,

Sanjay S

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

PhoneBoy — Wed, 22 Sep 2021 15:36:05 GMT

Make sure Remote Access is set as an Identity Source in the relevant gateway object(s).
Also, all gateways you are sharing identities with must be on the relevant version/JHF level in order to receive the acquired identities via Remote Access SAML.

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

Sanjay_S — Thu, 23 Sep 2021 17:11:05 GMT

Hi PhoneBoy,

Is there any lab to test this?

Regards,

Sanjay S

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

PhoneBoy — Thu, 23 Sep 2021 19:36:10 GMT

I would work with your local Check Point SE.

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

Sanjay_S — Tue, 28 Sep 2021 13:56:23 GMT

Hi PhoneBoy,

I have another question here with this after going through the configuration guide below.

https://dl3.checkpoint.com/paid/d9/d99fd83a9b0028e2e6ecb42ac23c840b/CP_R80.40_and_R81_Jumbo_Hotfix_SAML_For_VPN_RA.pdf?HashKey=1632825398_6786687bafbbcae2bb375612dc2ad008&xtn=.pdf

In Page 5 do we need to follow these below steps at all for the Mobile Access Client Based remote Access VPN at all?

i) From the left tree, click VPN Clients > SAML Portal Settings.
j) Make sure the Main URL contains the fully qualified domain name of the
gateway.
This domain name should end with a DNS suffix registered by your organization.
For example:
https://gateway1.company.com/saml-vpn
k) Make sure the Certificate is trusted by the end users’ browser.

Because our customer uses the IP address to connect to the Remote access VPN.

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

PhoneBoy — Tue, 28 Sep 2021 19:12:08 GMT

I guess you could use the IP here, but your users will likely encounter certificate errors doing so.

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

Sanjay_S — Mon, 11 Oct 2021 12:41:50 GMT

Hi PhoneBoy,

Thanks for guiding me all over this thread. I have one more query. In the Youtube link in the SK there is nothing shown to make the changes in the GuiDBEdit tool. But in the config guide from page 14 we see changes in the GuiDBEdit. Is that necessary for those changes to get the SAML authentication working for Mobile Access Remote Access VPN clients?

Regards,

Sanjay S

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

PhoneBoy — Mon, 11 Oct 2021 18:40:35 GMT

I assume these are required if they are in the written documentation.

Re: MFA Configuration for MobileAccess blade with Client(Checkpoint Endpoint Security)

Sanjay_S — Tue, 12 Oct 2021 11:42:46 GMT

Thanks PhoneBoy,

In case after making changes on GuiDBEdit Tool, User Machine changes and also running script on particular domain in the MDS. If it doesn't work and we need to revert the changes and use the Radius authentication itself. Then what will be the best way to revert the above changes. Changes in the dashboard are easy to revert but when it comes these above changes how we can revert and how we can get the Radius working again?

Regards,

Sanjay S