Mobile access VPN authentication question

[Herschel_Liang]

The client found SNX local user password complexity is low, but it seem that password length can set 8 characters at most. He want to know that is there exist increasing password length/complexity way? Can it be true? If no, 1. budget allow, which MFA way you recommend; 2. no budget, which MFA way you can suggest to increase secure for SNX? How to config?

[PhoneBoy · Accepted solution]

For local passwords, there is no way to change/increase complexity requirements aside from using "OS Password" authentication: https://community.checkpoint.com/t5/General-Topics/Supporting-more-Complex-Passwords-without-using-a...
Then you can leverage Gaia's password length/complexity requirements.

External authentication servers would need to be leveraged for any sort of MFA.
One option is Google Authenticator, which can be set up with FreeRADIUS on any Linux server.
Here's a writeup on how to set that up: https://community.checkpoint.com/t5/General-Topics/MFA-with-Google-Authenticator/m-p/39456#M8416

Most of the other "paid" MFA options would also integrate via RADIUS.
Okta and Duo are two options I've seen write-ups on.

[Herschel_Liang]

Test successfully. Very nice.