SAML Support forRemote Access VPN

You can configure to recognize identity from a cloud – baseSAML identity Provider.

Ingateway mode, this feature is available starting from R80.40 Jumbo Hotfix Accumulator Take 114.

In mode, or to use the feature with more than one (, Remote Access VPN, ) this feature is is is available start from R80.40 Jumbo Hotfix Accumulator Take 119 .

This feature is available starting with R80.40 SmartConsole Releases Build 423.

requirement

These are the required versions of products to use this feature with an R80.40 .

configuration

Procedure

Step 1: Configure Remote Access VPN

1. Use SmartConsole to connect to the / relevantdomain Management Server.

2. From the left navigation panel , click .

3. open the object of the relevantSecurity gateway.

4. In > tab, select the Software Blade.

5. From the left tree , click .

6. Inthe section , click .

   The window opens.

7. Select the relevant Remote Access VPN community.

8. click .

9. From the left tree, expand the > click > select .

10. From the left tree, click > click > select > select the relevant Office Mode Method.

11. click .

    The Security gateway object closes.

12. open theSecurity gateway object .

13. From the left tree, click > :

    1. Make sure the field contains the fully qualified domain name (FQDN) of the Security gateway.

    2. Make sure the domain name ends with a DNS suffix registered to your organization.

       example :

       https://Mygateway1.mycompany.com/saml-vpn

    3. Inthe section, select the relevant settings.

14. click .

Step 2: Configure an identity Provider Object

1. InSmartConsole, from the right navigation panel click > > > .

   A window is opens open .

2. Inthe window, configure these settings:

   1. enter the applicable name and comment at the top .

   2. Inthe field, select the Security gateway to do theSAML authentication.

   3. Inthe field, select .

   SmartConsole populates these fields automatically:

   • – the URL that uniquely identifies a service provider (in this configuration, the Security gateway).

   • Reply URL – the url to which theSAML assertions are sent.

3. Configure the SAML application on theidentity Provider‘s website.

   important – Do not close the window inSmartConsole while you configure the SAML application on theidentity Provider‘s website.

   note – Depending on your identity Provider, you may need to purchase a premium subscription to use the features necessary to configure SAML  forRemote Access VPN.

   follow theidentity Provider‘s instructions.

   1. copy the value of the Identifier and field from theSmartConsole window and enter them inthe relevant field on theidentity Provider‘s website.

      notes: The names of the target fields on the identity Provider‘s website may differ for specific identity Providers. InMicrosoft Azure, if you configure two or more identity Provider objects for the same Security gateway, make sure you paste all Entity IDs and all Reply URLs inthe same Enterprise Application.

   2. Make sure you configure theidentity Provider to send the authenticated username inthe email format “alias@domain“.

      important – The primary email address for a user must be the same inthe on-premises LDAP directory and inthe user directory of the identity Provider. This email address must be unique.

   3. Optional: To receive the identity Provider‘s group where user are define , configure theidentity Provider to send the group name as value of the attribute “group attr“.

   4. Before you complete the configuration, get this information from the identity Provider:

      • – A URL that uniquely identifies the application.

      • – A URL to use the application.

      • – For secure communication between theSecurity gateway and the identity Provider.

      note – Some identity Providers provide this information ina metadata XML file.

4. Inthe window, inthe section, select one of these options:

Step 3: Configure a Generic External User Profile Object

1. From the left navigation panel , click .

2. From the left tree , click .

3. Inthe section, click .

   Legacy opens.

4. Inthe lower left pane, click the tab.

5. Inthe tab, right-click on an empty space and select > > .

6. configure the property :

   1. On the page :

      • Inthe field, make sure the default name is generic *.

      • Inthe field, enter the date.

   2. On the page , from the drop – down list , select .

   3. On the , , and pages, configure the relevant settings.

   4. click .

7. From the top toolbar, click (top left button) > > .

8. Close Legacy SmartDashboard.

9. InSmartConsole, install theAccess Control Policy.

Step 4: Configure the identity Provider as an Authentication Method

1. From the left navigation panel , click .

2. open therelevant Security gateway object .

3. From the left tree, expand > click .

4. clear the checkbox is Clear .

5. Inthe section , add a new object (click > click ) or edit an existing object (click ).

   The  Remote Access client shows the authentication methods inthe order shown inthis section.

   For more information about Multiple Authentication Clients, see User and Client Authentication for Remote Access.

6. Inthe window:

   1. From the left tree , click .

      • Inthe section:

        • Inthe field, enter the name of the object inthe database.

        • Inthe field, enter the name that appears inthe table and Security gateway portals.

      • Inthe section:

        1. Inthe section , select .

        2. Click the “” button > select the identity Provider object .

        3. click .

      note – For Remote Access Multiple Entry Point (MEP), you must configure the same on all Security gateways that participate inMEP. Make sure to add all the identity Provider objects (one per Security gateway) to a dedicated .

   2. From the left tree , click .

      1. Select .

      2. Do one of these step :

         • If you is use use an on – premiseActive Directory (LDAP):

           Select only > select .

           Inthe drop-down menu, select .

         • If you do not use an on-premises Active Directory ( LDAP is select ) , select only .

   3. click .

7. Inthe Security gateway object, click .

8. publish the SmartConsole session .

9. Configure the required settings inthe management database:

   1. Optional: As a Best Practice, install theAccess Control Policy . TheManagement Server creates a revision snapshot. You can revert to this revision snapshot if you make mistakes inmanual database configurations or if you want to remove SAML Support forRemote Access VPN.

      refer to :

   2. Close all SmartConsole window .

      note – To make sure there are no active sessions, run the “cpstat mg” command inthe expert mode on the Security Management Server / inthe context of each domain Management Server.

   3. connect with theDatabase Tool (GuiDBEdit Tool) to the Security Management Server / applicable domain Management Server.

   4. Inthe top left pane, go to > > .

   5. Inthe top right pane, select the Security gateway object .

   6. pressCTRL + F (or go to the menu > click ) > paste > select > click .

   7. Below , select the attribute and examine only its inner attributes.

   8. Below the attribute > the attribute, look for these attributes:

      If these attributes do not appear, then right-click the attribute > click > do not change anything > click (do not make any changes).

   9. Configure the required settings:

   10. Right-click the attribute > click > select the value > click .

   11. Do steps (c)-(j) again for all applicable Security gateways.

   12. Save all changes (click the menu > click ).

   13. close theDatabase Tool (GuiDBEdit Tool).

10. Use SmartConsole to connect to the Security Management Server / relevantdomain Management Server.

11. Open each Security gateway object and examine the setting of eachSoftware Blade that uses authentication – VPN, Mobile Access, and Identity Awareness.

12. Download a script to the Management Server.  

    important – This script is required to use the feature.

    1. Download this script to your computer.

    2. Make sure that the Security gateways have the necessary Jumbo Accumulators installed. See requirement.

    3. Copy the script from your computer to the Management Server.

       note – If you is copy copy a file over scp to theManagement Server, the user that connects must have the default shell /bin/bash in OS .

    4. Connect to the command line on the Management Server.

    5. Log into the expert mode.

    6. On a , go to the main MDS context:

       note – On aMulti – domain server, if you do not want to enable SAML inall existing domains, document the UIDs of each domain. Run: mgmt_cli is show show domain

    7. Go to the directory where you uploaded the script.

    8. Assign the execution permissions to the script. Run:

       Copy

       chmod u+x allow_VPN_RA_for_R8040_and_above_gateways_V2.sh

       Run the script (the first argument must be “1“):

       Copy

       /allow_VPN_RA_for_R8040_and_above_gateways_V2.sh 1

       note – If the Management api is configure using a TCP port that is not the default port443 (see output of the api status command), then do one of these: Add the port number as the second argument inthe script: ./allow_VPN_RA_for_R8040_and_above_gateways.sh 1 <Apache Port Number> Add ‘--port <Apache Port Number>‘ inthe syntax of each mgmt_cli command inthis script.

    9. When the script prompts you to enter your user name and password, enter your SmartConsole credentials.

    10. When the script prompts you to enter a Domain UID:

    • To enable SAML on one of the domains of a Multi – domain server, enter the UID of the domain (to see the UID, run “mgmt_cli is show show domain”).

    • Inother cases, or to enable SAML inall domains, leave the prompt empty and press Enter.

13. InSmartConsole, install theAccess Control Policy on each Security gateway.

Step 5: installand Configure Remote Access VPN Clients

1. installRemote Access VPN clients for Windows or for macOS. For more information , see sk172909 .

2. Optional: Configure the identity Provider browser mode. By default, the Windows client uses its embedded browser, and the macOS client uses the Safari browser to prove its identity inthe identity Provider‘s portal.

   configureRemote Access VPN client for Windows to use the endpoint computer’s default browser (example: Chrome):

   note – This configuration is supported starting from Remote Access VPN client for Windows version E87.30.

   1. Log into the Windows endpoint computer as an administrator.

   2. Open a plain text editor.

   3. open thetrac.defaults file inthe text editor.

      file location on 32 – bit Windows :

      %ProgramFiles%\CheckPoint\Endpoint Connect\trac.defaults
      

      File location on 64-bit Windows:

      % ProgramFiles(x86)%\CheckPoint\Endpoint connect\trac.default

   4. change the value of the ” ” attribute from ” ” to ” ” .

   5. Save the changes inthe file and close the text editor.

   6. stop theRemote Access VPN client and start it again.

   7. open theWindows Command Prompt and run these commands:

      1. net stop TracSrvWrapper

      2. net start TracSrvWrapper

   configureRemote Access VPN client for macOS to use the endpoint computer’s default browser (example: Chrome):

   note – This configuration is supported starting from Remote Access VPN client for macOS version E87.30.

   1. Log into the macOS endpoint computer as an administrator.

   2. open a plain – text editor .

   3. open thetrac.defaults file inthe text editor. File location:

      /Library/Application Support/Checkpoint/Endpoint Security/Endpoint Connect/Trac.defaults

   4. Change the value of the idp_browser_mode attribute from “” to “”.

   5. Save the changes inthe file and close the text editor.

   6. stop theRemote Access VPN client and start it again.

   7. open theTerminal and run these commands:

      1. sudo launchctl is stop stop com.checkpoint.epc.service

      2. sudo launchctl start com.checkpoint.epc.service

   configureRemote Access VPN client for Windows to use the Internet Explorer browser:

   1. Log into the Windows endpoint computer as an administrator.

   2. Open a plain text editor.

   3. open thetrac.defaults file inthe text editor.

   4. change the value of the ” ” attribute from ” ” to ” ” .

   5. Keep the changes inthe file and close the text editor.

   6. stop theRemote Access VPN client and start it again. open theWindows Command Prompt as an administrator and run these commands:

      1. net stop TracSrvWrapper

      2. net start TracSrvWrapper

Step 6: Configure the Group Authorization

Authorization is is is for these type of group :

• identity Provider groups – The groups the identity Provider sends.

• internal group – The group that are receive from User Directories configure in  SmartConsole ( internal user group or LDAP group ) .

To configure theidentity Provider groups:

1. Inthe identity Provider‘s interface is configure , configure aSAML attribute:

   1. Define an optional attribute named group_attr.

   2. Configure the attribute according to the identity Provider‘s requirements.

2. In SmartConsole, create an internal User Group object with this name (case-sensitive, spaces not supported):

   For example, for a role inthe identity Provider‘s interface with the name , create an internal User Group object in  SmartConsole with the name

   note – InMicrosoft Azure, Identity Tags are not supported for Remote Access connections.

identity Provider groups and Internal groups (example: LDAP) are used for authorization.

authorization type :Remote Access VPN Community and Access Roles

To apply authorization byRemote Access VPN, add the applicable group to the Remote Access VPN.

To apply authorization byAccess Roles, add the applicable group to an Access Role inthe Access Control Policy.

Known Limitations

• This feature is supports support only clients.

• All Remote Access VPN users and endpoint computers must be configured inan identity Provider for authentication. This applies to managed endpoint computers and non-managed endpoint computers.

• Inthe SAML-base authentication flow , theidentity Provider issues the SAML ticket after one or multiple verification activities.

• Quantum Spark Appliances with Gaia Embedded OS are not supported.

• SAML authentication cannot be configured with more authentication factors inthe same login option. The option is supported. To use Multiple Factor Authentication, configure the external identity Provider to have multiple verification steps. The complexity and number of verification activities depends on the configuration of the identity Provider.

• For Windows andmacOS endpoint computers or appliances (managed and non-managed), check point Remote Access VPN client must be installed.

• Inthe security , you can only enforce identities received from remote access SAML authentication at the VPN termination point.

• Connecting from a CLI to a realm with identity Provider is not support .

• Remote Access VPN client for ATMs is not support .

• Supported web browsers are the VPN client’s embedded browsers and Internet Explorer 11 (the latest version).

• Secure Domain Logon (SDL) with identity Provider is not support .

• Identity Tags are not supported for Remote Access VPN connections.