Secureid Integration with RAdius server and checkpoing fw-1

[kpatel]

Background:
We currently have two divisions using different VPN authentication models that we need to combine. Our EC division uses native ACE with RSA tokens and the generic* group. Our CIS division uses Shiva RADIUS with VASCO tokens and just has to list the RadIUS groups on the Checkpoint firewall rulebase. They have role based VPN access where EC does not. the plan is to migrate the CIS implimentation onto the EC implimentation and replace all VASCo tokens with RSA tokens while maintaining their role based access and not requiring every individual username to be created on the firewall. Our initial thought was to use ACE server as RADIUS server and create the groups there while pulling in the usernames from Active Directory with LDAP sync but we have been having trouble getting the attributes to do what we want(Tom Hartig, one of my engineers can fill in the details here) So we are looking to talk through how we can best accomplish this integration. Maybe it would be best to keep the Shiva?
I am also curious about what the Active Directory integration opportunities are to be able to reduce the amount of userstores. How can RSA/RADIUS play with AD/IAS? How does the authentication flow work?

any ideas?

[munrog]

If you have the SMARTDirectory or PRO Addon license, then through the use of the LDAP protocol you can leverage Active Directory as a single authentication and user directory store.

You could set up an Active Directory Application Mode (ADAM) instance and then use the Check Point extended attributes to point the Firewalls at the specific Authentication service that each user needs to use.

The advantage of using an ADAM instance is that you wont have to play around with your production AD instance to get this working.

If you want to go the whole way, you could extend your ADAM instance with the CP attributes and then also implement the RSA/SecurID intregration for self provisioning etc. Dunno whether the VASCO side has this or not, I've not played with it.

Configuration information for Check Point and Active Directory is found in the standard Check Point documentation. However, configuration information for Check Point and ADAM is available in this guide.

Cheers
Greg