VPN Cert Auth - Read OU for User Groups

[OrkhanRustamli]

Hi All,

We are implementing certificate authentication for remote VPN without LDAP and AD. ISE is identity store and we are using ISE`s CA feature. 

The authentication is working fine, as auth is going internally in firewall but we also need user groups for policy management.

I wonder is it possible to configre CP to read OU from cert and add users to groups based on OU?

Thanks in advance!

[PhoneBoy · Accepted solution]

I believe we can only retrieve groups from LDAP.
However, if you're integrating with Cisco ISE, you should be able to use Identity Tags as a group source.
See: https://community.checkpoint.com/t5/Policy-Management/How-to-use-Identity-Awareness-Tags-in-R80-20-M...