LDAP with 2FA for admin access

[Martin_Sykora]

Hi.

I recently got asked by customer it it is possible to login to SmartConsole and CP gateways and management server and authenticate against the LDAP server (Free IPA) and on top of that they would generate and offline 2FA token with FreeOTP.

I am assuming that this can't be done. If I understand correctly Checkpoint devices only externally authenticate admin access against RADIUS and TACACS or there is the SecurID option of 2FA.

Can you confirm my suspicion?

R81.20 on management server / R81.10 on gateways

Thanks

[PhoneBoy]

For access to Gaia OS, LDAP cannot be used as an authentication mechanism.
Further, there is not a prompt for the second factor via RADIUS, it must be appended to the end of the password.