Remote Access Vpn SMB two factor autenthication

[Bac26]

Hello

Is it possible to use Microsoft Authenticator as second factor for Remote VPN access to SMB series centrally managed via Smart-1 Cloud

Any guide can refer too?

Thank you

[Chris_Atkinson]

Believe this is currently a limitation, refer: sk178604

Will check if it's planned to be resolved in the next release and revert.

[Bac26]

so kind MFA can you use? any suggestion?

[Chris_Atkinson]

Anything Radius based would likely work here. Possibly a integration via Microsoft NPS as an intermediary?

Recommended R81.10.x in this case so you have access to Radius 2.0

[Bac26]

Hello

are you sure as they show me those limitation

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

br

[Chris_Atkinson]

Radius is a workaround and not listed there as a limitation?

[PhoneBoy]

My understanding from talking with R&D is that the latest firmware (R81.10.05) has support for Remote Access SAML integrated.
However, because it has not been tested by QA to confirm it, it is still listed as a known limitation.
Assuming your Smart-1 Cloud tenant is on R81.20, then you should be able to apply the following: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

Having said that, this isn’t formally supported (yet).
If you want formal support, I recommend engaging with your Check Point SE.

Otherwise, you’re limited to using RADIUS + NPS as @Chris_Atkinson suggested.

[Bac26]

So beside it not using radius can you use any other multifactor authentication?

[PhoneBoy]

If the gateway was locally managed (not with Smart-1 Cloud) AND you were running the latest release, you could do MFA over Email or SMS.
Otherwise, you’re limited to using RADIUS or maybe TACACS.
Or try the SAML approach and share your feedback 🙂