Check Point Remote Access Integration with Azure AD MFA

[Patrickc]

HI All,

The customer currently has a requirement for two-step verification when connecting through Endpoint Security VPN. The first step requires entering the on-premises AD username and password, and the second step involves integrating Azure AD's MFA, using Microsoft Authenticator to enter a token. Is this achievable?

GW:R81.20

Thanks

[George_Casper]

Do you have sync enabled between on-prem AD and Azure AD?

[Patrickc]

Hi George，

Yes

[George_Casper]

So long as users and passwords are sync'd you can configure SAML auth directly to Azure AD.    There are two ways to hit Azure AD, one directly with SAML, the other with standing up a RADIUS server in the middle.   We chose the SAML method, less moving parts.   Depending on your M365 license levels you can add also on conditional access policies.

[Patrickc]

Hi George,

I want to use SAML for authentication. Could you please provide the setup method and steps?

[the_rock]

Maybe this guide would help?

Andy

[Patrickc]

Hi Rock，

Can I use Check Point without the NPS Extension for Azure MFA? Is it possible to integrate using Check Point’s IDP object via SAML?

[the_rock]

I think so.

[George_Casper]

We went with SAML as mentioned above, less moving parts.   Though I've read here on previous posts there may be a couple Checkpoint SMB models that may not support SAML depending on what you have.

[Patrickc]

Hi George,

I am using the Check Point 3800 appliance, not the Check Point SMB

[George_Casper]

See sk172909 for SAML config though I think there's a better SK if I remember gave better step by step  instructions.

 https://support.checkpoint.com/results/sk/sk172909

[the_rock]

Thats it.