Radius authentication broken

[toha]

Users are unable to login to VPN with Radius with Azure MFA extension installed. Users receive 3 text messages but are not able to type in the numbers. Users are prompted with "Access denied - wrong username and password"

We use Quantum Spark 1570 Appliance and Check Point VPN client.

If I disable MFA extension users are also prompted with "Access denied - wrong username and password"

[AkosBakos]

Hi @toha 

This auth method ever worked before?

Akos

[Chris_Atkinson]

Is the appliance locally or centrally managed and which firmware version/build is used?

[the_rock]

Agree with the questions guys asked, we need bit more details.

Andy

[PhoneBoy]

Most likely it is because of the mitigations related to BLAST RADIUS: https://support.checkpoint.com/results/sk/sk182516 
To the best of my knowledge, we have not implemented RADIUS Message-Authentication on the Check Point side, at least outside of the context of a specific fix from TAC.
Please open a TAC case: https://help.checkpoint.com 

[toha]

Hi guys

Sorry for the lack of details in my question, I was pushed from all directions to get this issue resolved.
I have found a Check Point SK that descripes the issue and provides a fix.

RADIUS authentication fails (checkpoint.com)

but the solution is not available in R81.10 'VPN Remote Access - RADIUS attribute to be ignored' is not visible.

[G_W_Albrecht]

As @PhoneBoy  wrote: Open a TAC case !

[toha]

When support has expired it is not an option.
Currently getting prices to get support again.

[G_W_Albrecht]

Usually, the 30 days grace period is enough time to renew it.

[toha]

I know but we are talking years here 😄

[G_W_Albrecht]

This will cost a lot as you have to pay for the time without support. Also, without services the SMB is pretty useless from a security standpoint - VPN can be created witth software, too, and you are not allowed to upgrade to a new firmware version.