Multi Factor authentication for RAVPN users with Google Authenticator on SMB devices

[mjovovic]

Hi,

I have setup 1590 appliance to work with RADIUS server for 2ND factor for RAVPN users.

Radius server is Ubuntu 20.04 with FreeRadius service on it.

Radius server part works as a charm, it communicates with Google Authenticator and makes authentication decisions according to user/pass/OTP policy setup.

Problem is that on our CP 1590 appliance side. After successful Radius authentication (RADIUS packets are exchanged between CP 1590 device and Radius server), RAVPN client gets disconnected every time (RAVPN connection is never completed).

SMB appliances use RADIUS v1, and because of that password length together with OTP from goolge authenticator should not be over 16 characters long (it is limitation on SMB appliances they can not use Radius v2).

In security logs we get:

Action: Failed Log In

Reason: Authenticated by RADIUS

Second authentication method: DynamicID 

Surely, this is where the problem is.

Our endpoint security VPN client shows: User XXX authenticated by Radius authentication

Check Point 1590 setup:

1. local users with ravpn permission created (according to Radius server - to match username and password with Radius server local users database)

2. Put users in user group with RAVPN permissions

3. Checked option  - Require users to confirm their identity using two-factor authentication 

Did not checked SMS option as we do not use SMS DynamicID (left it default):

4. Changed auth method on RAVPN client to Radius server

5.  We created authentication server (Radius):

Kindly ask You for a hint how to make this work?

All suggestions are welcome.

Thanks!

Milos

[mjovovic]

As addition to my first message,  if I check on 1590 GW the option - Require users to confirm their identity using two-factor authentication, 

on VPN client I got these two auth options:

With both auth. options from picture, RAVPN user gets successfully authenticated, but VPN tunnel establishment is not being started by 1590 appliance at all (no tunnel test traffic (port 18234) , it's like that VPND is not being triggered by these auth options),  and at the end client gets disconnected with messages like this:

Local/AD user (Default):

Radius user:

On the contrary, if I do not check on 1590 GW the option - Require users to confirm their identity using two-factor authentication, on VPN client there are many auth options (username/pass, SecureID, certs,...). But no radius at all.

[mjovovic]

VPN client side logs during testing with test radius user:

[G_W_Albrecht]

2FA currently only works with SMS, see To configure Two-Factor Authentication, Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.25 Locally Managed Administration Guide p.212 - so there is currently no way to achieve what you want !

[mjovovic]

Hi Albrecht,

I have just solved an issue by:

1. Deleting all users on CP 1590 appliance (which were already configured on Radius Server),

2. Creating Radius type group (checked all users, groups) and checked RAVPN permissions for Radius group,

3. Unchecking the option on CP - Require users to confirm their identity using two-factor authentication, 

4. In VPN client I choose auth. scheme (username/password).

And it works as a charm! Users are authenticated by external Radius server (FreeRadius on Ubuntu), which is further 

responsible for handling Google Authenticator OTP. Basically in VPN client, in password field we put together a password which is defined on Radius server along with OTP token from google authenticator app on Mobile phone in following manner:<passwordOTP>

[G_W_Albrecht]

Yes - 2FA is outsourced here to RADIUS. See sk137732: 2FA (Factor Authentication) support for remote access VPN in locally managed SMB appliance... for details about this R77.20.xx restriction.

With R80.20.xx., 2FA is possible for locally managed SMBs using SMS.

[mjovovic]

It would be great if we could be in situation to configure MFA directly on the Security Gateway (locally managed SMB appliance).

Thanks for comments.

[G_W_Albrecht]

Yes, certainly !

[G_W_Albrecht · Accepted solution]

It is listed in Limitations: sk159772: Check Point R80.20 for 1500, 1600, and 1800 Appliances Features and Known Limitations

Blade / Feature

Locally managed

Centrally managed

Comments

VPN and Remote Access

Remote access client multi factor authentication

Yes

No

SMS as second factor authentication.

#

[mjovovic]

Thanks Albrecht.

At the end, I really look forward that CP will as soon as support radius v2 on SMB appliances (to avoid authentication with up to 16 character passwords (Radius v1 - RFC 2138)).

[yangjiajun]

Why is this option that 'require users to confirm their identity using two-factor authentication' not available in my R80.20.05 experimental environment.

[MikeyT]

The option 'require users to confirm their identity using two-factor authentication' is available on the R80.20.10 ver. and above.

[security09]

Hi @mjovovic  - do you have the document for setting up this freeRadius and google authenticator. i did configure it but when i am trying to do a local test- it says packet rejected. not sure where have i done mistake. i am not very good in linux. it would be great if you can share the doc.

[G_W_Albrecht]

sk137732: 2FA (Factor Authentication) support for remote access VPN in locally managed SMB appliance...

[security09]

hi @G_W_Albrecht  This SK doesnt have freeradius method explained. the one which is mentioned is SMS based authentication. i need FreeRadius with GoogleAuth.

[G_W_Albrecht]

sk72940: How to configure RADIUS server for authentication on Gaia OS