Checkpoint VPN MFA

[bcmario]

Checkpoint VPN 2 factor authentication has been setup successfully, but now there is a requirement where the MFA (multi factor authentication) needs to be enforced on certain users and NOT all users.

Ex : - If there are 10 users, 8 of them will be enforced with MFA and the other 2 will not be enforced with MFA.

Is this possible?

[the_rock]

From what Im aware of, its not possible. I asked this exact question while via TAC case and they responded saying escalation team told them it was not feasible. This was back in 2023, but I have not heard otherwise since.

The only way I can see this working would be if you create local users in smart console and assign them specific auth method.

Maybe someone else can confirm.

Andy

[bcmario]

@PhoneBoy any idea whether this is still not possible or is there a workaround this now?

[PhoneBoy]

As far as I know the situation with this has not changed.
Recommend engaging your local Check Point office on this requirement.

[Ruan_Kotze]

Not sure if this classifies as a workaround but we managed to accomplish this. The catch is we're doing it through MS Authenticator via Entra Conditional Access Policies.

[the_rock]

How did you set up auth methods in smart console gateway object?

Andy

[garrod]

Hi,

I believe this depends on how you setup the MFA as what I understand as well, make sure to untick legacy authentication method. Let me know if it works

[Gaurav_Pandya]

Hi,

It depends on how you configure IDP. For example, Microsoft azure AD is your IDP then you can enforce 2FA setting in Azure AD. Firewall just forward request to azure AD and it will decide whether to enforce 2FA or not.

[the_rock]

Right, but thats generally how it works, not to exclude few users though.

Andy