topic Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices in Spark Firewall (SMB)

Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

mjovovic — Tue, 15 Jun 2021 12:30:46 GMT

Hi,

I have setup 1590 appliance to work with RADIUS server for 2ND factor for RAVPN users.

Radius server is Ubuntu 20.04 with FreeRadius service on it.

Radius server part works as a charm, it communicates with Google Authenticator and makes authentication decisions according to user/pass/OTP policy setup.

Problem is that on our CP 1590 appliance side. After successful Radius authentication (RADIUS packets are exchanged between CP 1590 device and Radius server), RAVPN client gets disconnected every time (RAVPN connection is never completed).

SMB appliances use RADIUS v1, and because of that password length together with OTP from goolge authenticator should not be over 16 characters long (it is limitation on SMB appliances they can not use Radius v2).

In security logs we get:

Action: Failed Log In

Reason: Authenticated by RADIUS

Second authentication method: DynamicID

Surely, this is where the problem is.

Our endpoint security VPN client shows: User XXX authenticated by Radius authentication

Check Point 1590 setup:

1. local users with ravpn permission created (according to Radius server - to match username and password with Radius server local users database)

2. Put users in user group with RAVPN permissions

3. Checked option - Require users to confirm their identity using two-factor authentication

Did not checked SMS option as we do not use SMS DynamicID (left it default):

4. Changed auth method on RAVPN client to Radius server

5. We created authentication server (Radius):

Kindly ask You for a hint how to make this work?

All suggestions are welcome.

Thanks!

Milos

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

mjovovic — Tue, 15 Jun 2021 15:07:52 GMT

As addition to my first message, if I check on 1590 GW the option - Require users to confirm their identity using two-factor authentication,

on VPN client I got these two auth options:

With both auth. options from picture, RAVPN user gets successfully authenticated, but VPN tunnel establishment is not being started by 1590 appliance at all (no tunnel test traffic (port 18234) , it's like that VPND is not being triggered by these auth options), and at the end client gets disconnected with messages like this:

Local/AD user (Default):

Radius user:

On the contrary, if I do not check on 1590 GW the option - Require users to confirm their identity using two-factor authentication, on VPN client there are many auth options (username/pass, SecureID, certs,...). But no radius at all.

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

mjovovic — Tue, 15 Jun 2021 15:34:25 GMT

VPN client side logs during testing with test radius user:

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

G_W_Albrecht — Wed, 16 Jun 2021 05:36:40 GMT

2FA currently only works with SMS, see To configure Two-Factor Authentication, Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.25 Locally Managed Administration Guide p.212 - so there is currently no way to achieve what you want !

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

mjovovic — Wed, 16 Jun 2021 07:49:11 GMT

Hi Albrecht,

I have just solved an issue by:

1. Deleting all users on CP 1590 appliance (which were already configured on Radius Server),

2. Creating Radius type group (checked all users, groups) and checked RAVPN permissions for Radius group,

3. Unchecking the option on CP - Require users to confirm their identity using two-factor authentication,

4. In VPN client I choose auth. scheme (username/password).

And it works as a charm! Users are authenticated by external Radius server (FreeRadius on Ubuntu), which is further

responsible for handling Google Authenticator OTP. Basically in VPN client, in password field we put together a password which is defined on Radius server along with OTP token from google authenticator app on Mobile phone in following manner:<passwordOTP>

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

G_W_Albrecht — Wed, 16 Jun 2021 08:08:16 GMT

Yes - 2FA is outsourced here to RADIUS. See sk137732: 2FA (Factor Authentication) support for remote access VPN in locally managed SMB appliances for details about this R77.20.xx restriction.

With R80.20.xx., 2FA is possible for locally managed SMBs using SMS.

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

mjovovic — Wed, 16 Jun 2021 12:50:13 GMT

It would be great if we could be in situation to configure MFA directly on the Security Gateway (locally managed SMB appliance).

Thanks for comments.

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

G_W_Albrecht — Wed, 16 Jun 2021 15:05:57 GMT

Yes, certainly !

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

G_W_Albrecht — Thu, 17 Jun 2021 19:45:14 GMT

It is listed in Limitations: sk159772: Check Point R80.20 for 1500, 1600, and 1800 Appliances Features and Known Limitations

Blade / Feature

Locally
managed

Centrally
managed

Comments

VPN and Remote Access

Remote access client multi factor authentication

Yes

SMS as second factor authentication.

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

mjovovic — Fri, 18 Jun 2021 11:33:22 GMT

Thanks Albrecht.

At the end, I really look forward that CP will as soon as support radius v2 on SMB appliances (to avoid authentication with up to 16 character passwords (Radius v1 - RFC 2138)).

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

yangjiajun — Mon, 30 May 2022 10:51:28 GMT

Why is this option that 'require users to confirm their identity using two-factor authentication' not available in my R80.20.05 experimental environment.

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

MikeyT — Mon, 06 Jun 2022 23:47:03 GMT

The option 'require users to confirm their identity using two-factor authentication' is available on the R80.20.10 ver. and above.

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

security09 — Mon, 14 Nov 2022 10:56:06 GMT

Hi @mjovovic - do you have the document for setting up this freeRadius and google authenticator. i did configure it but when i am trying to do a local test- it says packet rejected. not sure where have i done mistake. i am not very good in linux. it would be great if you can share the doc.

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

G_W_Albrecht — Mon, 14 Nov 2022 11:04:43 GMT

sk137732: 2FA (Factor Authentication) support for remote access VPN in locally managed SMB appliance...

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

security09 — Mon, 14 Nov 2022 14:29:52 GMT

hi @G_W_Albrecht This SK doesnt have freeradius method explained. the one which is mentioned is SMS based authentication. i need FreeRadius with GoogleAuth.

Re: Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

G_W_Albrecht — Tue, 15 Nov 2022 09:48:53 GMT

sk72940: How to configure RADIUS server for authentication on Gaia OS