Enabling 2FA on Remote Access VPN Gateway for Vendors

[chuka01]

We have a customer who uses a gateway (it is in a cluster, but is the only cluster member) for remote access VPN, for both staff and vendors. Staff login with their domain credentials and their authentication method is a RADIUS server with 2FA enabled. Vendors authenticate with their checkpoint account password into a server where they have to input another set of domain credentials.

Now this customer wants to enable 2FA for those vendor accounts, and I suggested dynamicID with the OTP sent to the vendor's emails. I am thinking that enabling dynamicID on the gateway will also require their staff accounts for another 2FA code, which makes the workflow more inconvenient for staff. Can anyone help with a safe and secure way to enable 2FA just for vendor accounts? Thank you.

[simonemantovani · Accepted solution]

Hello

did you evaluate to configure the multiple login option and create a specific authentication mode for thi vendors? When configured, they could change the authentication settings into their VPN client to use this new authentication mode.

Here are the steps from the admin guide: https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_MobileAccess_AdminGuide/Content/To...

(it R82 version, and specific for the Mobile Access, but it's the same also on previous versions, and multiple login option can be configured also under the VPN clients section).

[chuka01]

Hello Simon,

Thanks for responding. Yes, i have created a username and password + dynamicID authentication method under mobile access > authentication on the specific gateway. I am trying to enforce this, and not make it an option. WIll this change not make staff need a 2nd OTP from their email? as they already authenticate via a RADIUS Server + OTP.

[PhoneBoy · Accepted solution]

If you don't want it to apply to staff, you will need to add DynamicID as part of Multiple Login Options instead.