Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Explorer

VPN - Limit specific vendors to specific IPs on Checkpoint Vpn

We just implemented Checkpoint VPN. We have several vendors that have access to specific systems. When they use CP VPN, is there a way to limit their access to specific IP addresses based on their user group?

0 Kudos
Reply
4 Replies
Participant

Do you use site-to-site or client-to-site VPN?

If client-to-site, do you use local users or AD/LDAP?

0 Kudos
Reply
Explorer

We have client to site via CP Mobile and have LDAP groups setup currently for the main office users who need to connect remotely.

0 Kudos
Reply
Admin
Admin

It comes down to how you are determining what groups these users belong to.
Assuming it's AD as you suggest below, then yes, you can create an Access Role for the relevant user groups and set up the appropriate access policy rules.
0 Kudos
Reply
Explorer

Thanks for the response. I'm going to spell this out a bit as I don't see any step by steps for the new folks to checkpoint. If you have a specific vendor that VPNs into your network and has to connect to a specific IP or host on your network, this is what you do...or the way I did it.

1. To keep my AD clean, I created a single OU for vendors in AD. Then later referenced that single OU and the applicable vendor IDs in my CP object creation in the following steps.

2. Create the Vendor account in the OU that you created in step 1

3. Create the objects for the vendor, the network or hosts that the vendor needs to connect to in Checkpoint. **When creating the object for the vendor in CP, you will need the full Distinguished name.**

4. Our VPN subnet for CP is housed in the firewalls, so I added the vendor account to the group authorized to access the VPN subnet.

5. Created a rule that allowed our vendor, which has was added to the VPN subnet, as the source.

6. I added the IP address / host name that the vendor was trying to access as the destination. When adding the Host name of the destination, I had to add the primary/secondary DC (dns) to the destination or it would not allow access by host name.

7. Specify any specific protocols required for the connection,

8. Set CP to accept and log.

9. Install & Publish

10. Test

 

 

 

0 Kudos
Reply