topic Re: Radius authentication broken in Spark Firewall (SMB)

Radius authentication broken

toha — Fri, 30 Aug 2024 09:23:48 GMT

Users are unable to login to VPN with Radius with Azure MFA extension installed. Users receive 3 text messages but are not able to type in the numbers. Users are prompted with "Access denied - wrong username and password"

We use Quantum Spark 1570 Appliance and Check Point VPN client.

If I disable MFA extension users are also prompted with "Access denied - wrong username and password"

Re: Radius authentication broken

AkosBakos — Fri, 30 Aug 2024 11:20:00 GMT

Hi @toha

This auth method ever worked before?

Akos

Re: Radius authentication broken

Chris_Atkinson — Fri, 30 Aug 2024 11:30:10 GMT

Is the appliance locally or centrally managed and which firmware version/build is used?

Re: Radius authentication broken

the_rock — Fri, 30 Aug 2024 12:53:22 GMT

Agree with the questions guys asked, we need bit more details.

Andy

Re: Radius authentication broken

PhoneBoy — Fri, 30 Aug 2024 17:24:48 GMT

Most likely it is because of the mitigations related to BLAST RADIUS: https://support.checkpoint.com/results/sk/sk182516
To the best of my knowledge, we have not implemented RADIUS Message-Authentication on the Check Point side, at least outside of the context of a specific fix from TAC.
Please open a TAC case: https://help.checkpoint.com

Re: Radius authentication broken

toha — Tue, 03 Sep 2024 08:01:12 GMT

Hi guys

Sorry for the lack of details in my question, I was pushed from all directions to get this issue resolved.
I have found a Check Point SK that descripes the issue and provides a fix.

RADIUS authentication fails (checkpoint.com)

but the solution is not available in R81.10 'VPN Remote Access - RADIUS attribute to be ignored' is not visible.

Re: Radius authentication broken

G_W_Albrecht — Tue, 03 Sep 2024 09:02:28 GMT

As @PhoneBoy wrote: Open a TAC case !

Re: Radius authentication broken

toha — Tue, 03 Sep 2024 09:11:15 GMT

When support has expired it is not an option.
Currently getting prices to get support again.

Re: Radius authentication broken

G_W_Albrecht — Tue, 03 Sep 2024 10:41:11 GMT

Usually, the 30 days grace period is enough time to renew it.

Re: Radius authentication broken

toha — Tue, 03 Sep 2024 12:15:50 GMT

I know but we are talking years here 😄

Re: Radius authentication broken

G_W_Albrecht — Tue, 03 Sep 2024 12:34:37 GMT

This will cost a lot as you have to pay for the time without support. Also, without services the SMB is pretty useless from a security standpoint - VPN can be created witth software, too, and you are not allowed to upgrade to a new firmware version.