Machine certificate OR User Certificate authentication

[Thomola]

Hello,

we are looking to setup an authentication via either Machine Certificate OR User Certificate. Unfortunately, most of the guides regarding machine certificate authentication are always working in the sense of "machine certificate is a must". I have found and tried solution from this older sk121173 that enabled a fallback on user authentication without the need for machine certificate, but without success.

Current state that we are in works as guides intends, which means pre-logon VPN tunnel is established via machine certificate, then user logs into Windows, tunnel is destroyed and new one is created with both machine and user certificate.In the second step we would like to eliminate the need for both user and machine certificate. Perfect solution would be similar to the behavior from the before mentioned sk121173.

Is this still possible to setup? We have not managed to do so yet.

Thank you in advance.

[PhoneBoy]

I believe the "fallback" is only supported for a non-certificate based method.
This should probably be confirmed with TAC: https://help.checkpoint.com