Device Based Authentication on VPN

[agk]

Hi all,

My customer wants a configuration that only spesific machines(windows with domain/non-domain, and mobile devices) can connect VPN.

1) We cant use SCV because of the non-supported devices.

2)We cant use directly LDAP computer authentication because of the non-domain clients.

--> I have thought client certificate can be used; so I've made some tests;

For mobile devices, it works like a charm. They directly enrolled from the device and enrollment key can not be used again.

But for Windows devices; first you need to enroll it; app asks you for a password and create p12 certificate. Then you can import it to your personal certificates, and it works.

Here is the thing about that; it asks password directly from the endpoint user; so they can export this certificate and import it anywhere else and be able to use. We have tested this and the certificate which is working for one computer, had worked on another computer for authentication. 

What customer need is a VPN with p12/pfx certificate(which has password created by customer so end users can not install and export it). I am thinking that there is a proper way to do this; but for a while I couldn't find it. I have checked below:

1) https://community.checkpoint.com/t5/Security-Gateways/HowTo-Set-Up-Certificate-Based-VPNs-with-Check...

This seems to be a good guide for using certificate for vpn, but anyways it has no password configuration on anywhere either.

2) In remote access admin guide (https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_RemoteAccessVPN_AdminGuide/C...) there is a phrase says:

"The administrator can also initiate a certificate generation on the ICA management tool. It is
also possible to use third-party Certificate Authorities to create certificates for authentication
between Security Gateways and remote users. The supported certificate formats are
PKCS#12, CAPI, and Entrust. "

It seems its possible; but I couldn't find how.

Thanks a lot, Have a good day!

[PhoneBoy]

For Domain computers, you can use a Machine Certificate, which is managed via GPO.
This can be required in addition to the regular user authentication.
Those are not exportable, as far as I know.

Whether you can create a machine certificate for a non-domain computer is a separate question.
Because, unfortunately, I don't see how you can allow specific "non-domain" machines without either using SCV or a machine certificate as you can't really restrict the client certificate usage.

[agk]

Hi PhoneBoy, thanks for your reply.

I think without direct certificate auth; we can use below:

Mobile Devices(Tablet,phone etc)  --> Client Certificate(From internal CA directly) + Username/Password

Windows computers with vpn client (domain and non-domain) --> SCV + Username+Password (Or for domain devices we can use Machine certificate but there is no alternative for non-domain windows machine, it seems that we need to use SCV)

MacOS computers --> ???

There is 2 question in here:

1) For windows computers; What SCV type should i need to use for this devices? (For example we can check registry for "HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates" path with installing a spesific certificate.) You have any other suggestion?

2) Do you have any configuration on your mind for MacOS computers?

Thanks!

[PhoneBoy]

You can use SCV on Mac also, but I don't believe you can look for the presence of a certificate using it: https://support.checkpoint.com/results/sk/sk182226