Hi all,
My customer wants a configuration that only spesific machines(windows with domain/non-domain, and mobile devices) can connect VPN.
1) We cant use SCV because of the non-supported devices.
2)We cant use directly LDAP computer authentication because of the non-domain clients.
--> I have thought client certificate can be used; so I've made some tests;
For mobile devices, it works like a charm. They directly enrolled from the device and enrollment key can not be used again.
But for Windows devices; first you need to enroll it; app asks you for a password and create p12 certificate. Then you can import it to your personal certificates, and it works.
Here is the thing about that; it asks password directly from the endpoint user; so they can export this certificate and import it anywhere else and be able to use. We have tested this and the certificate which is working for one computer, had worked on another computer for authentication.
What customer need is a VPN with p12/pfx certificate(which has password created by customer so end users can not install and export it). I am thinking that there is a proper way to do this; but for a while I couldn't find it. I have checked below:
1) https://community.checkpoint.com/t5/Security-Gateways/HowTo-Set-Up-Certificate-Based-VPNs-with-Check...
This seems to be a good guide for using certificate for vpn, but anyways it has no password configuration on anywhere either.
2) In remote access admin guide (https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_RemoteAccessVPN_AdminGuide/C...) there is a phrase says:
"The administrator can also initiate a certificate generation on the ICA management tool. It is
also possible to use third-party Certificate Authorities to create certificates for authentication
between Security Gateways and remote users. The supported certificate formats are
PKCS#12, CAPI, and Entrust. "
It seems its possible; but I couldn't find how.
Thanks a lot, Have a good day!
