Google Authenticator MFA not working with SMB 1530 gateway in R81.10.07

[David_GOURANTON]

Hello,

R81.10.07 for Spark gateways brings Google Authenticator MFA for remote access users.

We have enabled the feature but now mobile access users cannot log in anymore. Yet they have received an email with the 2FA QR code and enrolled their mobile phone, but they cannot authentificate. They have tried to concatenate the password with the token code as a prefix or a suffix, remplace the password with the token code, and also enter the token code in the "SecurID" field.

Did anyone try this new feature ? Does it work ?

Regards,

D

[_Val_]

Did you follow sk137732 when setting it up?

[David_GOURANTON]

Yes, except that there is now a new option to enable Google Authenticator in the Two-Factor Authentication Settings panel. Users have received the email with the QR code, but cannot authenticate.

[_Val_]

Please open a support call with TAC: https://help.checkpoint.com

[Tom_Hinoue]

Assuming the gateway is locally managed... I have tested it before and confirmed it worked.
One thing I did beforehand, is if you're using Endpoint Security VPN then upgrade it to version E87.30.

I think I had some issues authenticating if the Endpoint version was old.

[_Val_]

Second that. I assumed the client version is the latest, but did not ask for it, so worth checking as well.

[David_GOURANTON]

We are using a clientless access. Can you confirm that you need to concatenate the password and the Google Authenticator token code ?

[PhoneBoy]

When you say "Clientless Access" what precisely do you mean?

[David_GOURANTON]

I mean SSL Network Extender. Does SNX support 2FA on Spark gateways ? After we enter our login and password, the appliance does not ask for an OTP and the logon page appears again as if the authentication failed.

[PhoneBoy]

Right, SNX does not ask for an OTP, you will have to enter it at the end of your fixed password.

[ikafka]

Hi @David_GOURANTON 

You need to check these two checkboxes.

You also need to enter the e-mail address of the VPN users.
As you mentioned, the QR code comes as an e-mail.
I didn't do anything other than these settings, it works for my device.

My device version: R81.10.07 (996001397