binding ip address with mac address for users

[medtiti92]

Hi 

i'am using Checkpoint 9100 with R80.20 as SMS. I would like to assign each user IP address with a mac address. That's mean, if i take a IP address of my neighboor i can't access to network or internet 

can we do this in checkpoint ?

[PhoneBoy · Accepted solution]

MAC addresses are not something you can “assign” as they are determined by the hardware the user is using.
We also don’t do any enforcement based on MAC address, therefore no ability to bind a user to a MAC.

[the_rock]

What type of user exactly?

Andy

[medtiti92]

When i said bind ip address with mac address, i mean if the IT department give the ip : 192.168.76.89 to computer_user_1, so i want to bind this ip address with the mac address of the computer computer_user_1.

Some users IP address are able to access some categories of sites, so if someone is absent, some users are able to table their ip address to reach those categories sites ..;

[the_rock]

The closest thing I can think of would be below.

Andy

 

[medtiti92]

@the_rock thanks for your reply, but it's vpn client for the remoter users. What i want is for the local network.

[the_rock]

As Phoneboy said, thats not sadly possible, sorry.

Andy

[PhoneBoy]

A Check Point gateway can do this enforcement irrespective of the IP address with Identity Awareness and App Control/URL Filtering.
That assumes the policy is enforced on a Check Point gateway, of course.

[medtiti92]

How can i do that in checkpoint gateway ?

[the_rock]

Maybe access role? Not sure, let @PhoneBoy  confirm.

[PhoneBoy]

A lot more information about the environment would be necessary to give you specific answers.
In general, though, you need to configure access to the relevant identity sources, create Access Roles, and create the relevant access rules using those Access Roles.
Supported identity sources include:

• On-premise Active Directory
• Identity Agents (for individual-use PCs and multi-user systems like Terminal Servers)
• RADIUS Accounting
• Identity Web API
• Remote Access
• Identity Collector 
• Captive Portal (supports Kerberos)

More on the above can be found here: https://sc1.checkpoint.com/documents/Identity_Awareness_Clients_Admin_Guide/Content/Topics-IA-Client... 
See also: https://support.checkpoint.com/results/sk/sk86441 

[PhoneBoy]

See also the podcast I did talking about Identity Awareness Best Practices, the notes for which link to more detailed sessions on the topic: https://community.checkpoint.com/t5/CheckMates-Go-Cyber-Security/S06E08-Identity-Awareness-Best-Prac... 

[medtiti92]

Thanks @PhoneBoy for these idea, i will read all of this and hope find solutions.