[KB3489] How do I configure my Check Point Software SSL VPN device for use with ESET Secure Authentication?

Solution

Introduction

This article describes how to configure a Check Point Software SSL VPN device to authenticate users against an ESA Server. Before proceeding, verify that you've installed the RADIUS Server component of ESET Secure Authentication and can access the RADIUS service that enables external systems to authenticate users.

Before your Check Point Software SSL VPN device can use the ESA Server to authenticate users via RADIUS, it must be set up as a RADIUS client on the ESA Server. Next, your server running the ESA RADIUS service must be set up as a RADIUS Server on the Check Point Software SSL VPN device. When these configurations have been specified, you can start logging into your Check Point Software SSL VPN device using ESA OTPs.

NOTE

This integration guide utilizes Client does not validate user name and password Client type for this particular VPN appliance. If you wish to utilize other Client type, refer to generic description of Client types and verify with the vendor if the VPN appliance supports it.

Step I - RADIUS client configuration

To allow the Check Point Software SSL VPN device to communicate with your ESA Server, you must configure the Check Point Software SSL VPN device as a RADIUS client on your ESA Server:

  1. Log in to ESA Web Console.

  2. Navigate to Components → RADIUS and locate the hostname of the server running the ESA RADIUS service.

  3. Click the hostname, then click Create New Radius Client.

  4. In the Basic Settings section:

    1. Give the RADIUS client a memorable name for easy reference.

    2. Configure the IP Address and Shared Secret for the Client so that they correspond to the configuration of your VPN appliance. The IP address is the internal IP address of your appliance. If your appliance communicates via IPv6, use that IP address along with the related scope ID (interface ID).

    3. The shared secret is the RADIUS shared secret for the external authenticator that you will configure on your appliance.

  5. In the Authentication section apply the settings shown in Figure 1-1 below

Configuring your RADIUS client

  • To prevent locking any existing, non-2FA enabled AD users out of your VPN we recommend that you allow Non-2FA users during the transitioning phase. It is also recommended that you limit VPN access to a security group in the Users section.
  • Make sure that the check box next to Mobile Application is selected.

Figure 1-1

ESA has now been configured to communicate with the Check Point Software SSL VPN device. You must now configure the Check Point Software SSL VPN device to communicate with the ESA Server.

 

Step II - Configure your Check Point Software SSL VPN device


Follow the steps below:

  1. Open Check Point SmartDashboard.
  2. Expand the Servers and OPSEC Applications page.
  3. Right-click Servers and select New RADIUS.
  4. Name your new server (for example, ESA).
  5. Click New next to the Host field.
  6. Select General Properties on the left.
  7. Add a name for the server (for example, ESAradserv).
  8. Enter the IPv4 address of your ESA RADIUS server.
  9. Click OK.
  10. Select New Radius (for port 1812) from the Service drop-down menu.
  11. Enter your shared secret, as shown in Figure 1-1.
  12. Select PAP as the protocol.
  13. Click OK.

 

Step III - Create a test user


  1. Navigate to and expand Users and Administrators.
  2. Right click Users and select New UserDefault.
  3. Type the AD user name of your test user (for example, Alice) into the general tab under User Properties.
  4. In the Authentication tab:
    1. Set the authentication scheme to RADIUS.
    2. Select the server you created in section II.
  5. Click OK.

 

Step IV - Test the connection


To test the newly configured connection:

  1. Launch your Check Point Software SecureClient.
  2. Enter the credentials of your test user. Ensure that you are using an account with Mobile Application 2FA using ESA enabled. When prompted for a password, append the OTP generated by the Mobile Application to your AD password. For example, if the user has an AD password of Esa123 and an OTP of 999111, you should type Esa123999111.

 

Troubleshooting

If you are unable to authenticate via the ESA RADIUS server, make sure that you have performed the following steps:

  1. Run a smoke test against your RADIUS server, as per the “Verifying ESA RADIUS Functionality” document.
  2. If no faults were fixed and you are still unable to connect, revert to an existing sign-in configuration that does not use 2FA and verify that you are able to connect.
  3. If you are able to connect using the old settings, restore the new settings and verify that there is no firewall blocking UDP 1812 between you VPN device and your RADIUS server.
  4. If you are still unable to connect, contact ESET technical support.