Cannot get LDAP group to authenticate Check Point Mobile VPN users

[Joe_Kanaszka]

Hello guys.

I'm running into an issue when trying to use an LDAP Group to authenticate my VPN users.

What I would like to do:

Create a "Remote Access" group in my AD and add authorized accounts to this group.

In SmartConsole - under Users\Identities, create a new LDAP group with my "Account Unit" being my AD Group object I've already configured.

For the LDAP Group "Scope", I'm choosing the middle option: "Only Group in Branch (DN prefix)

When I select that option, my domain gets filled in in the field on the right: ,DC=mydomain, DC=com  (lead comma)

In the left field I input the rest of the DN of the group: CN=remote_users, CN=users  (no trailing comma)

However I cannot login via my Check Point Mobile client with this option for LDAP Group.

When I try and connect with my VPN client:

User name - OK

Password - OK

DUO prompt - click OK

Immediately kicked out with bad username/password error.

I can connect if I change the LDAP group option to "All Account-Unit's Users".

Any ideas?

Edit for future visitors to this question:

Cannot use "Domain Users" for an LDAP group:

https://support.checkpoint.com/results/sk/sk32479

Solution - create an AD security group for remote access and use that.

[ruidias]

Have you added the user or group to the Remote Access Community? Are there any related entries in the logs?

[Joe_Kanaszka]

Thank you!  Right now we're testing and trying to authenticate with "Domain Users".  Does not work,  We ran  some debugs and even though I know my user account is a member of "Domain Users" - the Check Point does not see me as a member of that group.  That's why authentication is failing....

[simonemantovani]

Just few questions:

1. when the authentication fails, what is reported in logs&monitor? which error is reported?
2. the ldap group scope you mentioned is it right? I mean, the user belongs to that LDAP group?

[Joe_Kanaszka]

Thank you!

Answer to your first question - Nothing in the logs.  Traffic not reaching gateway

Answer to your second question - Yes - my account is definitely a member of "Domain Users", but the Check Point does not think so.

[simonemantovani]

It's strange that logs are empty, you should find at least a log with action equal to "Log in failed" that will explain the wrong username or password errore displayed by the client; in addition, you could try to collect the logs directly from the vpn client and check if there is something useful within the logs. If you want attach the logs to this post.

https://support.checkpoint.com/results/sk/sk169258