Possibility to limit User Access via Management Server

[Roadrunner88]

Hello Guys,

is it possible to limit the access for a user that has access to the management server, only to get view and/or access to dedicated firewalls that are present on the management server?

Thanks

[G_W_Albrecht]

Concerning what can be done in Dashboard: No, permissins are not that granular - see here how it can be restricted: https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SecurityManagement_AdminGuide/Cont...

[Tal_Paz-Fridman]

For access to the Security Gateway machine you can set individual Gaia administrators per machine with specific roles.

In Gaia Portal go to - User Management > Users or Roles

[AkosBakos]

Hi @Roadrunner88 

The Multi-Domain Management is the sholution for this:

https://www.checkpoint.com/quantum/multi-domain-security-management/

Akos

[G_W_Albrecht]

This is not the solution - remember how expensive MDM licenses are, so if you need one SMS to manage your gateways, you will not pay x-times its price to get such options. I also do not know if this granular access does not only concern CMAs (as each CMA could have a different admin, a concept that makes sense).

[AkosBakos]

True, I had such kind of discussion with one of our customer. They didn't buy MDS....

[the_rock]

I believe what @Tal_Paz-Fridman said also makes lots of sense to me. See attached.

Andy

[G_W_Albrecht]

NO - the question is about granular admin rights on SMS by Dashboard (user that has access to the management server can only view and/or access dedicated firewalls on the management server), not about GAiA portal access on different gateways.

[Roadrunner88]

thanks for the answers so far ...so it will not be so easy to archive

[G_W_Albrecht]

Rather impossible - only by using one CMA per GW in MDM, which is very expensive...

Better use admins that are trustable and let them swear on the bible that they will only touch their GW in Dashboard 😉 As all actions are recorded, you can always trace who did what when on which rule or GW...

[Roadrunner88]

:D:D ok that workaround is even better, we will do that 😉

[the_rock]

@Roadrunner88 

FWIW, here is what AI Copilot said, though to me, does not seem like it would work for you : - (

Andy

is it possible to limit the access for a user that has access to the management server, only to get view and/or access to dedicated firewalls that are present on the management server?

09:41 AM

Yes, it is possible to limit the access for a user to only view and/or access dedicated firewalls on the management server. This can be achieved by creating specific permission profiles and assigning them to the user. Here are the steps to do this:

1. Create a Permission Profile:

   • Open SmartConsole and go to the "Manage & Settings" tab.
   • Under "Permissions & Administrators," select "Permission Profiles."
   • Click "New" to create a new permission profile.
   • Define the permissions for the profile. You can set the profile to allow only read access or specific access to certain features.

2. Assign the Permission Profile to the User:

   • Go to "Manage & Settings" > "Permissions & Administrators" > "Administrators."
   • Select the user you want to modify or create a new user.
   • Assign the previously created permission profile to the user.

3. Limit Access to Specific Firewalls:

   • In the same user settings, you can specify which firewalls (Security Gateways) the user has access to.
   • Under the "Permissions" tab, you can define the specific objects (firewalls) the user can access.

By following these steps, you can ensure that the user has limited access to only view and/or manage specific firewalls on the management server.

Learn more:

1. R81.10 Quantum Security Management Administration Guide - Managing-User-and-Administrator-Accounts
2. R80.40 Security Management Administration Guide - Managing-User-and-Administrator-Accounts
3. R77 Security Management Administration Guide - 41613
4. R81.20 Quantum Security Management Administration Guide - Managing-User-and-Administrator-Accounts
5. R81 Quantum Security Management Administration Guide - Managing-User-and-Administrator-Accounts
6. R81.20 Identity Awareness Administration Guide - Acquiring-Identities-for-Active-Directory-Users
7. R81.10 Identity Awareness Administration Guide - Acquiring-Identities-for-Active-Directory-Users
8. R82 Identity Awareness Administration Guide - Acquiring-Identities-for-Active-Directory-Users
9. Quantum Spark R80.20.10 Centrally Managed Administration Guide for 1500 Appliances - Working-User-Aw...
10. Quantum Spark R80.20.15 Centrally Managed Administration Guide for 1500 Appliances - Working-User-Aw...

[the_rock]

I was thinking maybe with below, but dont see an option for specific gateways though...

Andy