topic Re: Remote Access VPN by RADIUS auth. in SASE and Remote Access

Remote Access VPN by RADIUS auth.

Fabien — Tue, 20 Jul 2021 06:21:22 GMT

Hello,

I am using CheckPoint SG5100 (v80.30) and I want to change the remote access authentication from "Username Password" to "RADIUS".

Once configured with this documentation :

- https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjqn6W7-vDxAhVyh_0HHbiLA0sQFjAAegQIBRAD&url=https%3A%2F%2Fcommunity.checkpoint.com%2Ffyrhh23835%2Fattachments%2Ffyrhh23835%2Fremote-access%2F1655%2F1%2FUsing%2520RADIUS%2520Authentication%2520for%2520Remote%2520Access%2520VPN.pdf&usg=AOvVaw3a3CPvBLeumDhLWAS-a_g9

- + CheckPoint documentation

I have a very strange result.

RADIUS authentication is done correctly using the CheckPoint EndPoint VPN Client, IF there is a local user with the same username as the account used for RADIUS authentication. For any other AD account being in the VPN group, and not having a local account, the VPN Client returns me the error: "Negociation with site failed".
I don't know if I missed something.

Could you please explain me where my problem comes from?

Thanks in advance

Re: Remote Access VPN by RADIUS auth.

_Val_ — Tue, 20 Jul 2021 11:37:24 GMT

First, the original document you are refering to, is published here: https://community.checkpoint.com/t5/Remote-Access-VPN/White-Paper-Using-RADIUS-Authentication-for-Remote-Access-VPN/td-p/53659

It would be much more useful if you ask the questions by that tread.

Also, it seems your LDAP group is not configured properly. Please make sure your LDAP server and associated group are defined, before checking again your RADIUS config.

Also, please make sure you worked though the admin guide for RAS VPN: https://sc1.checkpoint.com/documents/R80.10_andhigher/WebAdminGuides/EN/CP_RemoteAccessVPN_AdminGuide/html_frameset.htm

Also, what is the client version?

Re: Remote Access VPN by RADIUS auth.

Fabien — Wed, 21 Jul 2021 09:43:35 GMT

My client version : E83.10.

Okay thanks, i will check this out and will use the other topic for my questions.