topic Re: How to Configure Check Point to forward VPN Certificate authentication request to Cisco ISE in SASE and Remote Access

How to Configure Check Point to forward VPN Certificate authentication request to Cisco ISE

Edmund_Carbon — Thu, 27 Aug 2020 23:11:33 GMT

Hi, has anyone configured Check Point Gateway to forward VPN request using Certificates to Cisco ISE for authentication to AD.

Basically users with Capsule Connect client will VPN into the Gateway using only a pre-configured certificate push by an MDM. Check Point will receive the request and forward ito ISE. Cisco ISE will authorize and authenticate using Active Directory. The request should come back to Check Point gateway and then user will be allowed access to the network.

Thanks

Re: How to Configure Check Point to forward VPN Certificate authentication request to Cisco ISE

PhoneBoy — Thu, 27 Aug 2020 23:49:06 GMT

You don't really "forward" requests for certificate authentication anywhere.
You import the relevant CA key into the Check Point management (as an OPSEC CA) and set your gateway (cluster) object to accept this CA as valid for VPN purposes.
We can validate the certificate and the other attributes in the certificate, associating it to the relevant user.
I believe that can be Cisco ISE (via RADIUS), but haven't tried it myself.

Re: How to Configure Check Point to forward VPN Certificate authentication request to Cisco ISE

Edmund_Carbon — Fri, 28 Aug 2020 00:31:28 GMT

Thanks PhoneBoy,

Are you saying I still need to import the customers CA Key for verification using SSLVPN to do a cert request like the below example?

Will this be one cert per cluster or do I need a cert per gateway?

Do I then to add ISE as a Radius server and the Domain Controller as and LDAP server? I saw a few threads related to needing both configured in smartconsole

Re: How to Configure Check Point to forward VPN Certificate authentication request to Cisco ISE

PhoneBoy — Fri, 28 Aug 2020 04:52:15 GMT

You would import the CA key once and configure each gateway to accept it.
And yes ISE would be configured as RADIUS and AD for LDAP.