Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Alex_Rozhko
Employee
Employee

snx

Probably OLD and not interesting Q... but.. When SNX came out it was WOW factor... especially for those who managed to make AD/SMS 2-fa work. As time went by it became more and more unreliable. Is there any plans on CP dev team to make mobile clients be AD integrated and SMS compatible for 2-fa authentication? Certificates was good idea but it seems does not work with enterprise PKI, only FW internal.

0 Kudos
6 Replies
G_W_Albrecht
Legend
Legend

Sorry, but i feel i do not understand the question Smiley Sad. 2FA and MAB/SNX/RA VPN are explained in sk86240 Multiple Authentication Schemes for Mobile Access / Remote Access.

But i think you are (also?) talking about log in to Dashboard = SMS, that is a different pair of shoes...

CCSE CCTE CCSM SMB Specialist
Alex_Rozhko
Employee
Employee

Sorry was not clear about SMS. In my case it is pin via text message as 2nd factor, which does not work with other mobile/RA clients, but only with SNX.

0 Kudos
G_W_Albrecht
Legend
Legend

I do not know of any 2nd factor, which does not work with other mobile/RA clients, but only with SNX - if you mean Legacy SNX with Mobile Access blade disabled, according to sk86240 there is no 2nd factor, only defined on user or cetificate. With Mobile Access Portal / SNX, Capsule Workspace and Endpoint Security VPN, Check Point Mobile for Windows/Mac OS X, SecuRemote you have 2nd factor auth.

CCSE CCTE CCSM SMB Specialist
0 Kudos
Timothy_Hall
Champion
Champion

Hi Alex,

The formal name of the feature you are talking about here is DynamicID.  Essentially you enter a cell phone number into a user record, after the user successfully provides their login and password (the first factor), a text is sent to their cell phone with a code they must then enter (the second factor).  As far as I know this technique is only available for use with the Mobile Access Blade (which includes SNX).

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos
Matan_Suissa
Employee
Employee

Hey Alex.

I am Matan Suissa VPN TL in QA. I will send your question to Mobile QA people to verify if and when  "make mobile clients be AD integrated and SMS compatible for 2-fa authentication?" is planed.

Can you please expand a bit about why  "As time went by it became more and more unreliable." is SNX is unreliable? is 2FA is?

Thanks.

0 Kudos
Alex_Rozhko
Employee
Employee

SNX unreliability, I am referring to is Network Mode. Using it from Windows 10 and latest MAC OS(es) is the most problematic. Seems like latest Microsoft TCP/MSS deployment contributed to the issue the most (windows side), on MAC side had no choice but switch users to RA clients that do not support SMS/2fa and AD integration in general (back to local accounts).  Initial connection and authentication to MAB works fine, problem is when SNX has to be loaded (will take several attempts and in some cases have to remove/reinstall all SNX components to make it work), or after SNX is loaded (rdp sessions will disconnect randomly, and the only way to reconnect is to kill session completely and start all over). There was good idea one time to provide web-enabled rdp proxy, but it never took further on CP side (open source Guacamole rdp-proxy unsupported). It will be also nice for "portfix" (AD integration and authentication to multiple domains using UPN be included in jumbo(s) or in the code and not requested for every new JHF (my firewall infrastructure is r80.10).

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events