Checkpoint endpoint VPN with Microsoft 2-Factor Authentication.

[edd080]

Good Day to all,

                         we currently have our checkpoint endpoint vpn authentication which uses username, password and dynamicid which sends an sms to the user in order to complete the logon.

We would like to change the dynamicid portion to Microsoft's two factor authentication. I am aware that a radius server is needed for this, however is there an sk or guide which can help us out on how checkpoint can be configured for this?

Thanks in advance.

[Alex-]

Which version are you using? Here are the r80.10 guides:

http://dl3.checkpoint.com/paid/87/87d47e947768228c17e5473013b23286/CP_R80.10_RemoteAccessVPN_AdminGu... 

http://dl3.checkpoint.com/paid/77/774c3c923f00c927527600aadaab3fcf/CP_R80.10_MobileAccess_AdminGuide... 

[Chris_Atkinson]

Further to the relevant sections of the admin guide please see:

sk114263: Can an Azure Multi-Factor Authentication Server be used as a RADIUS server for Mobile Access authentication?

[edd080]

Thank you for your guides will have a look at them.

[Simone_Balboni]

Hello, curious if you succeeded in this configuration. I am on it as well with the aim of replacing an RSA AuthMgr.

Simo

[edd080]

Hi sorry for the late reply, we still haven't got on it yet but will let you know once we get it up and running.

[Konstantinos_In]

Hello

Did you finally configure it?

BR,

Kostas

[Simone_Balboni]

Hello,

fyi  this setup implies:

1) download a RADIUS proxy VM from Microsoft and configure it to talk to our Azure tenancy MFA instance

2) point checkpoint to that internal RADIUS proxy as a MFA provider

I was expecting a more direct connection i.e. Checkpoint to my Azure MFA tenancy directly, but it is not the case.

I have not yet investigated aspects like: how does the system behave if Azure MFA is down or not reachable etc? Are there emergency connection procedures etc?

Best regards,

Simone

[Konstantinos_In]

Hello Simone

Can you please kindly share checkpoint configuration and NPS configuration or some hints?

As concerns emergency procedure you could configure another Login option on checkpoint vpn client with one factor authentication.

BR,
Kostas

[TOM_MORAN]

does Checkpoint support Azure mfa in the way it does for example duo ?

any help is appreciated

Thanks

Tom

[Rodrigo_Silva]

See if this post can help you.

https://community.checkpoint.com/t5/General-Management-Topics/Checkpoint-VPN-with-Microsoft-2-Factor...

Good luck.