SAML Support for Remote Access VPN

[PhoneBoy]

This question has come up a lot on the community.
We now have a formally supported solution that allows integration with ADFS and other SAML-based authentication.
This requires Check Point gateways running (at minimum) the following releases:

• R80.40 JHF 114 or above (not supported with Maestro)
• R81 JHF 42 or above (not supported with Maestro)
• R81.10 JHF 9 or above (not supported with Maestro)
• R81.20 (supported with Maestro) and above

The following VPN clients are supported (minimum versions listed):

• E84.70 on Windows
• E85.30 on macOS
• Capsule VPN clients (see sk181494), which requires the following gateway versions:
  • R81.10 JHF 43 and above
  • R81.20 JHF 113 and above 

This solution is NOT currently supported with:

• Capsule Workspace
• Embedded Gaia/SMB Gasteways

If such support is needed, please open an RFE with your local Check Point office.

You can see the details in the R81.20 Remote Access VPN guide under SAML Support for Remote Access VPN and/or sk172909.

See also this video by @Peter_Elmer 

To view this video, you must Accept and consent to the use of cookies.

Accept

(Last edited April 2024)

[PhoneBoy]

As far as I know, it is still required.
Your best bet is to confirm with the TAC.

[faridb]

hello , 

i know it's an old thread but i need a recommendation on how to implement SAML with ADFS ( not Azure AD ) so an on prem server ?

is this the same setup ?

Regards,

[PhoneBoy]

I assume there are some differences between Azure AD and ADFS.
However, the configuration on the Check Point end should be similar as SAML is fairly generic.

[SenpaiNoticed_U]

SMB appliances now support SAML as of R81.10.15 firmware 
sk182438

[fabionfsc]

I updated to version R81.10.15 and confirmed that it now really works, but recently, I rebooted my Quantum Spark and the Azure login screen just keeps loading (a blank screen), I'm going to do a new reboot to test, since recreating the entire authentication method didn't work.

[fabionfsc]

Rebooted and now its fine.