Recon User for CyberArk Password Rotation

[LostBoY]

We have a Checkpoint Cluster deployed in AWS on R81.20
we are planning to integrate it  with CyberArk i.e. administrator login via cyberark.

I wanted to know if Checkpoint supports recon user configuration with CyberArk i.e Automatic Password Rotation via CyberArk for user logins ? 

is there any official documentation for this.

thanks 

[PhoneBoy]

We don't have a specific integration with Cyberark that I'm aware of.
That doesn't mean it won't work, of course.

[Norbert_Bohusch · Accepted solution]

There is an official supported integration by CyberArk which comes out-of-the-box which supports reconcile.

https://docs.cyberark.com/pam-self-hosted/Latest/en/Content/PASIMP/CheckPoint-GAiA-plugin.htm

[LostBoY]

Thanks..for this to work only cyberark users with admin privilidge are required ? or any specific configuration at Firewall end.

[Norbert_Bohusch]

In the environments I use it, we manage either built-in admin or other local accounts through CyberArk. For this no special configuration is needed.

To get into expert mode a bit more configuration is needed, with 2 options:

- Save expert password as separate account (unmanaged) and use Gaia account as logon account

- Set expert-authentication-mode to user-password and use a grouped dummy account as expert password (allows to use expert for different users)

[LostBoY]

Thank you for the reply...this also takes care of password rotation via cyberark I believe ?

[Norbert_Bohusch]

Sure

[LostBoY]

Thank you..i will test this out.