IAS and certificates. Is it feasible?

[slimo]

Hi,

Would it be possible to set up IAS and Checkpoint so that the vpn users need to provide username/password as well as certificate to be able to authenticate?

Thanks

[RayPesek]

Can you give me an example of what you're trying to accomplish with this requirement?

We use a similar setup with Connectra for computers that do not belong to us, but I don't know how FW-1 would use it.

On Connectra, we use an FW-1 ICA certificate to authenticate the computer/user to the portal to eliminate the problem with guessed user names and passwords. Then we have the end user enter Windows credentials for access to Windows resources. A Server 2003 IAS box works as the RADIUS server.

Ray

[slimo]

I would like to set up two requirements before an user can be authenticated:

1. a user can only use his/her computer to authenticate. Cannot use another computer (ie colleague's computer or home computer). I think this is where we need to use certificate.

AND

2. provide a Windows username and password.

Is this two requirements are possible? If yes, is there then anyone in this forum has a set up like this. We have currently NGX R60 on a Nokia 350

Thanks for your help

Slimo

[RayPesek]

If they can export the certificate or simply copy it, it will be portable between computers.

This code in local.scv will check the name of the domain that the computer is a member of. It can be beat by naming a home computer to the same name as the domain name, though:

: (RegMonitor
:type (plugin)
:parameters (
:string ("SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winl ogon\DefaultDomainName=OURDOMAIN")
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Your computer account password is invalid. The Help Desk has been notified.")
:end (admin)
)
)


I don't know of any way to require both a Windows account and certificate to complete a login.

Ray

[RayPesek]

I don't know why it's putting a space in \Winlogon\. It's not there when I try to edit it out.

Rai

[slimo]

Thanks. Apparently nobody has this configuration in place.
Today I installed a test environment (AD, Checkpoint, IAS). My next step is to install Windows Enterprise Root CA. Deploy certificates to computers and set a policy in IAS to allow only computers with cerificates and valid user/password.

If people are interested I will let you know the result.

Have a nice weekend

Slimo

[RayPesek]

I'm interested.

Thanks,

Ray

[ppnair@gmail.com]

I am intertested too and thinking of this.. What happened NEXT???

Praveen