2FA for ssl VPN

[kevin100]

Hai

One of the client needs to enable 2FA, MFA for ssl vpn  checkpoint for 15 users .

Client got on premise AD and no radius server.

Please provide a recommended solution, and what components required for that solution, like radius server

[AkosBakos]

Hi, hard situation. Low cost, not so beautiful, but certificate based VPN can be the solution.

Page 40: 

Digital User Certificates
Digital Certificates are the most recommended and manageable method for authentication.
Both parties present certificates as a means of proving their identity. Both parties verify that the
peer's certificate is valid (i.e. that it was signed by a known and trusted CA, and that the
certificate has not expired or been revoked).
Digital certificates are issued either by Check Point's Internal Certificate Authority or third-party
PKI solutions. Check Point's ICA is tightly integrated with VPN and is the easiest way to
configure a Remote Access VPN. The ICA can issue certificates both to Security Gateways
(automatically) and to remote users (generated or initiated).
Generate digital certificates easily in SmartConsole > Security Policies > Access Tools >
Client Certificates.

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/C...

[kevin100]

Hai thanks for the reply, will Duo 2fa work with checkpoint ssl VPN 

[AkosBakos]

Hi @kevin100 

I thought that you don't want to invest any money.

If yes, the Cisco DUO is the one of the best and cheapest solution for this. I have experience with that, it works, as expected!

Akos

[kevin100]

Dear Akos

Thanks for the info, do this solution setup need a separate radius server?

Also hope checkpoint ssl vpn works with laptops 

Thank you

[AkosBakos]

Hi @kevin100 

A small connector tool is needed for the Cisco DUO. It must be installed locally.

SSL VPN ha browsed dependencies. It should work with laptop, of course,

Akos

[the_rock]

Yea, DUO works 100%. I know few customers who use it without any issues.

Andy