topic Re: Radius Authentication for Remote Access VPN users in Centrally SMB managed gateways in SASE and Remote Access

Radius Authentication for Remote Access VPN users in Centrally SMB managed gateways

nagaraja_cs — Wed, 26 Aug 2020 06:29:10 GMT

Hi Team,

We have a centrally managed SMB gateway appliance 1400.

Configured Remote Access VPN which was working fine.

Now we want to enable Radius authentication for these users.

Radius authentication works fine for VPN users in locally managed gateway.

I want to know if this is supported on centrally managed gateway.

Re: Radius Authentication for Remote Access VPN users in Centrally SMB managed gateways

G_W_Albrecht — Wed, 26 Aug 2020 07:31:43 GMT

Yes it is - see e.g. Check Point 1400 Appliances Centrally Managed Administration Guide R77.20.87 p.102, Managing Authentication Servers. It is configured in the Users & Objects > Authentication Servers page as on locally managed units.

Re: Radius Authentication for Remote Access VPN users in Centrally SMB managed gateways

nagaraja_cs — Wed, 26 Aug 2020 08:14:09 GMT

Hi Albrecht,

Thank you for the info.

I am not able to completely download this guide,it takes me to web guide which will show only first page of the guide.

Our gateway is on R77.20.20,is it supported on this version too ?

As per your suggestion if we add radius server as Authentication Server in 'Users and Administrator' section,how this authentication will be applied to VPN users.

We are getting error "ISP Links are not properly configured.Click the setup...button" in Smart Console when we select Radius auth for VPN users.

ISP's are properly configured and it is working fine.

How Radius Auth and ISP configuration are related here ?

Re: Radius Authentication for Remote Access VPN users in Centrally SMB managed gateways

G_W_Albrecht — Wed, 26 Aug 2020 10:48:15 GMT

I would suggest to install firmware R77.20.87 (990173004) first. RADIUS server is configured in the Embedded Gaia WebGUI Users & Objects > Authentication Servers page as on locally managed units. Not in Dashboard...

Re: Radius Authentication for Remote Access VPN users in Centrally SMB managed gateways

nagaraja_cs — Wed, 26 Aug 2020 11:12:57 GMT

Hi Albrecht,

Yes,we will try that,is there any document which states that it is possible/not possible in case of centrally managed device.

If we add Radius Server as Authentication Server in 'Users and Objects',I assume this setting is for Gateway login.How it is relevant to VPN users,where we can mention that RAVPN users should authenticate with RADIUS server.

I need a confirmation,if this requirement possible with R77.20.87,then only I can suggest customer to upgrade the firmware.

Re: Radius Authentication for Remote Access VPN users in Centrally SMB managed gateways

nagaraja_cs — Thu, 27 Aug 2020 09:49:58 GMT

Hi Team,

Is there any information on this ?

Where can I enable the blade and configure VPN(On Smart Console or on Gateway Portal) ?

Is there any document for centrally managed gateway ?

Re: Radius Authentication for Remote Access VPN users in Centrally SMB managed gateways

G_W_Albrecht — Fri, 28 Aug 2020 09:37:59 GMT

Configuration is mostly done in Dashboard, see Check Point 1400 Appliances Centrally Managed Administration Guide R77.20.87 p.10ff ! Without the Guide you will not get far, so please get it...

sk105380 - Check Point R77.20 for 600 / 700 /1100 / 1200R / 1400 Appliance Known Limitations

sk92741: Gaia Embedded OS features

sk112858: ATRG: Gaia Embedded Appliances

RA VPN RADIUS is set here:

>> if this requirement possible with R77.20.87,then only I can suggest customer to upgrade the firmware.

If the customer is unwilling to use the newest firmware R77.20.87 (990173004), security is not the thing he really values...