topic Re: Client Based VPN Always Connect in SASE and Remote Access

Client Based VPN Always Connect

stuart2020 — Mon, 19 Oct 2020 06:20:57 GMT

Hello All,

Is it possible to enable the always connect functionality on the VPN client to provide users with limited access to some internal network resources but then require users to provide 2FA to access more restricted parts of the internal network?

Any information would be appreciated.

Thanks

Re: Client Based VPN Always Connect

G_W_Albrecht — Mon, 19 Oct 2020 07:54:46 GMT

No - client downloads the topology from the site that defines his access. You would have to use two different entry points with different authentication and different topology for each to make this possible, one limited RA VPN site and one larger RA VPN Site using 2FA.

Re: Client Based VPN Always Connect

Chris_Atkinson — Mon, 19 Oct 2020 07:57:46 GMT

What is the user experience that you are looking for and are you using MFA/2FA for your VPN access already today?

Note R80.40 Introduced the support for Captive Portal integration with SAML 2.0 and third party Identity Providers, refer:

https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_IdentityAwareness_AdminGuide/Content/Topics-IDAG/SAML-Identity-Provider-Configuration.htm

Re: Client Based VPN Always Connect

stuart2020 — Mon, 19 Oct 2020 08:35:31 GMT

Hi Chris,

I was trying to allow users to automatically connect to the VPN when they first login to their laptops remotely. Giving them limited access to some internal applications / systems - e.g. AD, corp Intranet site, holiday booking system etc. If users need to access more sensitive applications / systems - e.g. file server, tier 1 applications etc. They would need to connect with MFA/2FA for enhanced security. Not just allowing the username / password passthrough when logging onto the laptop for limited access. The clients are running a mixture of Windows 10 and Windows 7 OS connecting to Active Directory. We don't have MFA/2FA in production yet, but I have been testing it with an on prem Microsoft NPS server connecting to Azure AD which seems to be working well. The limited access is for convenience and to force end users to connect back to the main network for checking into AD, having new group policies pushed out etc. We use Office 365 for email and some file sharing, so we have a large number of back office staff who never have a requirement to connect back to the main network. This can cause issues with managing the end user experience.