Machine Cert Walkthrough

[tadams]

Hi Guys,

Here is a walkthrough on how to enforce Machine Certs on Remote Access VPN on R80.40. I mainly showed the CP side but I can do a walkthrough on how to deploy AD CS if needed.Also added a PowerPoint with the prerequisites to deploy. I hope this can be a help!

Machine Certs.mp4

Video Player is loading.

Play Video

Play

Mute

Current Time 0:00

/

Duration 0:00

Loaded: 0%

0:00

Stream Type LIVE

Seek to live, currently behind liveLIVE

Remaining Time -0:00

1x

Playback Rate

Chapters

• Chapters

Descriptions

• descriptions off, selected

Captions

• captions settings, opens captions settings dialog
• captions off, selected

Audio Track

Picture-in-PictureFullscreen

This is a modal window.

Beginning of dialog window. Escape will cancel and close the window.

Text

ColorWhiteBlackRedGreenBlueYellowMagentaCyanTransparencyOpaqueSemi-Transparent

Background

ColorBlackWhiteRedGreenBlueYellowMagentaCyanTransparencyOpaqueSemi-TransparentTransparent

Window

ColorBlackWhiteRedGreenBlueYellowMagentaCyanTransparencyTransparentSemi-TransparentOpaque

Font Size

50%75%100%125%150%175%200%300%400%

Text Edge Style

NoneRaisedDepressedUniformDropshadow

Font Family

Proportional Sans-SerifMonospace Sans-SerifProportional SerifMonospace SerifCasualScriptSmall Caps

Reset restore all settings to the default valuesDone

Close Modal Dialog

End of dialog window.

Close Modal Dialog

This is a modal window. This modal can be closed by pressing the Escape key or activating the close button.

[Olle]

Thanks, perfect for me 👌
Please do a walkthrough on deploy AD CS.

Regards
Olle

[Zabula_Sergey]

> Please do a walkthrough on deploy AD CS

+1 )

[Milan_Jovanovic]

Hi Tadams,

Regarding this solution you described Machine Cert I have few questions:

When we implement Machine Cert is it possible at same time for some LDAP AD users for example in specific group or OU to use just AD user pass authentication without Machine Cert?

 When we implement Machine Cert are we able to authenticate with mobile device (Android,IOS etc) with endpoint client using same AD user for which is mandatory machine cert?

When we use AD + machine cert auth is it possible in same time for some users to use Local defined in SMS user+cert+pass endpoint authentication?

If answers are yes on this questions, can all of this function in same time?

[Milan_Jovanovic]

Also interested in walkthrough on deploy AD CS.

[yunier88]

Hi,

Please do a walkthrough on deploy AD CS.

Thanks

[archie]

Hello!

I have done all the necessary things, but for me this machine cert auth is not working. Is there any correct explanation how to setup that? I have installed root CA and intermediate CA on the gateway, I have a machine cert on the client side, in the SMS I check the send machine cert checkbox, the gateway authenticates with the 3rd party certificate.

But when I connect I got the Main Mode Client machine identification failed and Client machine identification failed errors.

Any help would welcome!

Thanks

[sambath]

A great sharing!
Please do a walkthrough on deploy AD CS.

Regards,
Sambath

[flachance]

On your VPN client, when you create your site to connect to, what setting do you use for Authentication? Standard? With Certificate - CAPI for authentication?