ipassignment.conf and LDAP grop

[Joe_Kanaszka]

Hello again.

Continuation of a previous post but the old post is marked as resolved (because it was) to allow contributor to receive credit.  😊

In a nutshell - we need to limit access to a network host to a small group of 5 individuals.  The solution has to work with NAT (Identity Awareness is out as it doesn't work with NAT).  This solution will be used for WFH users - the current OM IP pool is Nat'd to the internal interface of the Check Point.  

My solution:

I'd like to configure the ipassignment.conf file to assign a range of IPs to my already existing AD group - then limit access to the resource based on the static IPs. (This will be used for WFH users).

What I've done:

• Created a draft of my ipassignment.conf file

Here is how my ipassignment.conf file will look referencing SK:  sk33422 

#Gateway             Type             IP Address                User Name

==================================================

IP of gateway        range          10.0.0.0-10.0.0.5       Test Group  (AD group)

• Created an LDAP Account Unit that points directly to my AD group - so the UID is my group. 
• Trying to create an LDAP Group Object that the ipassignment.conf file can reference.  The Group's scope is the first option - "All Account-Unit's Users"

Questions:

1. Unfortunately, my AD security group contains a space in the name.  When I try and create the LDAP group, I'm receiving the error "Object name contains space..."  How can I get around this?  
2. Will this plan work?  🙄

Thank you, and as always - any help is always much appreciated!

Best Regards,

Joe

[PhoneBoy · Accepted solution]

Even if you could get past the UI validation in SmartConsole, I suspect that space will be problematic in ipassignment.conf as well.
Change the name to something without a space.
Otherwise, this should work.

[Joe_Kanaszka]

Ok cool. Thank you!  

[DAKad]

Hello,

we have configured the file for an LDAP user but the user is not receiving the ip.

as you can see on both screenshots, we pushed the file on both gateways of the cluster

[PhoneBoy]

Please refer to https://support.checkpoint.com/results/sk/sk33422 for what exactly to use based on how the user authenticates.

[DAKad]

Hello PhoneBoy,

see the screenshot of the line added at the end of the file.

user log to the vpn through LDAP with the AD account , his name is on capital letter from active directory but when he wants to connecte on the VPN client, he use small letter like i wrote on the file and it works but still taking the ip from the pool instead of the ipassignment file

Also after checking with vpn ipafile_check $FWDIR/conf/ipassignment.con detail , i get the  output on the second screenshot

[PhoneBoy]

It's user/password authentication, right?
What if you put it in as it is in AD (i.e. with a Capital)?
If this doesn't work, suggest involving TAC.