- Products
- Learn
- Local User Groups
- Partners
-
More
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
IDC Spotlight -
Uplevel The SOC
Important! R80 and R80.10
End Of Support around the corner (May 2021)
We just implemented Checkpoint VPN. We have several vendors that have access to specific systems. When they use CP VPN, is there a way to limit their access to specific IP addresses based on their user group?
Do you use site-to-site or client-to-site VPN?
If client-to-site, do you use local users or AD/LDAP?
We have client to site via CP Mobile and have LDAP groups setup currently for the main office users who need to connect remotely.
Thanks for the response. I'm going to spell this out a bit as I don't see any step by steps for the new folks to checkpoint. If you have a specific vendor that VPNs into your network and has to connect to a specific IP or host on your network, this is what you do...or the way I did it.
1. To keep my AD clean, I created a single OU for vendors in AD. Then later referenced that single OU and the applicable vendor IDs in my CP object creation in the following steps.
2. Create the Vendor account in the OU that you created in step 1
3. Create the objects for the vendor, the network or hosts that the vendor needs to connect to in Checkpoint. **When creating the object for the vendor in CP, you will need the full Distinguished name.**
4. Our VPN subnet for CP is housed in the firewalls, so I added the vendor account to the group authorized to access the VPN subnet.
5. Created a rule that allowed our vendor, which has was added to the VPN subnet, as the source.
6. I added the IP address / host name that the vendor was trying to access as the destination. When adding the Host name of the destination, I had to add the primary/secondary DC (dns) to the destination or it would not allow access by host name.
7. Specify any specific protocols required for the connection,
8. Set CP to accept and log.
9. Install & Publish
10. Test
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY