> Source: [sk121173](https://support.checkpoint.com/results/sk/sk121173) # sk121173 - Machine Certificate Installation on Security Gateway for Authentication to VPN Clients | Property | Value | |----------|-------| | Solution ID | sk121173 | | Date Created | 2017-11-08 | | Last Modified | 2022-05-13 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20 | | OS | Gaia | ## Solution This solution describes Machine Authentication configuration on the Security Gateway. **This Machine Authentication solution is relevant for E80.71 (and above) Remote Access Clients and requires a Security Gateway hotfix installation.** ### **Note: The feature is integrated starting from R80.40 and the feature configuration will be through the Security Management. If you are planning to upgrade to R80.40, note you have to enable this feature on the Security Management.** Contact Check Point Solution Center via the local Check Point office to get the required **hotfix.** For client configuration, refer to the [Remote Access Clients for Windows 32/64-bit E80.72 and higher Administration Guide](http://downloads.checkpoint.com/dc/download.htm?ID=60345). **Machine Authentication Configuration on the Gateway** ------------------------------------------------------- By default, the Security Gateway allows VPN connections **with machine and user authentication** , and with **user authentication only** . To allow clients that connect using machine authentication only, or machine and user authentication, edit the gateway configuration. The Hotfix is supported on top these versions: * Machine Authentication HF on top of **R80.10** Jumbo HF **Take 245** and above. * Machine Authentication HF on top of **R80.20** Jumbo HF **Take 117** and above. * Machine Authentication HF on top of **R80.30** Jumbo HF **Take 132** and above. * If you are using an older version of this fix which is not mentioned above, the following configuration doesn't apply and you should upgrade to a newer version. Configuration (With feature's HF): ---------------------------------- * The feature will be enabled by default (Like in previous versions). * The registry flag was changed to machine_cert_auth (See below). * Setting the registry flag to an invalid value will reset the state of the feature to "enabled". (See below)
**To configure the gateway to allow only clients that connect using machine authentication only, or machine and user authentication (Machine authentication is a must) :** 1. On the Security Gateway run: *# ckp_regedit -a SOFTWARE/CheckPoint/VPN1 machine_cert_auth 2* 2. Install policy. Connections with user authentication only are rejected. **To allow clients to connect without a machine certificate:** 1. On the Security Gateway run: *# ckp_regedit -a SOFTWARE/CheckPoint/VPN1 machine_cert_auth 1* 2. Install policy. All valid authentication is accepted. **To disable the feature entirely (The client will not send machine certificate even if it's present):** 1. On the Security Gateway run: *# ckp_regedit -a SOFTWARE/CheckPoint/VPN1 machine_cert_auth 0* 2. Install policy. All valid authentication is accepted. Machines will not be authenticated. Note: If machine authentication (*machine_cert_auth*) is enabled, and there is a problem with the machine certificate (CRL problem, expired certificate, missing certificate, etc), users will not be allowed to connect. To allow for machine authentication with fallback to user authentication, set machine_cert_auth to 1 (The enabled mode). Setting the *machine_cert_auth to 1*will allow for: * Machine authentication (provided the certificate is installed/valid, and trac.defaults is configured for machine tunnel) * AND/OR * User authentication **To check if machine authentication is enforced:** On the Security Gateway, run: *# ckp_regedit -p SOFTWARE/CheckPoint/VPN1 \| grep machine_cert_auth* ? The following output shows that machine authentication is a mandatory authentication factor in connection to Security Gateway: *SOFTWARE/CheckPoint/VPN1 : { CurrentVersion=\[s\]6.0 machine_cert_auth=\[s\]2 }* ? The following output shows that the feature is in legacy mode and other authentication methods which not include machine are also allowed: SOFTWARE/CheckPoint/VPN1 : { CurrentVersion=\[s\]6.0 machine_cert_auth=\[s\]1 } ? The following output shows that the feature is disabled: SOFTWARE/CheckPoint/VPN1 : { CurrentVersion=\[s\]6.0 machine_cert_auth=\[s\]0 }
*** ** * ** *** **Machine Authentication Configuration on SmartDashboard** ---------------------------------------------------------- 1. Configure the LDAP server, so the Security Gateway will be able to fetch the machine information from it. * For more information see: LDAP and User Management in the [R77 Security Management Server Administration Guide](https://sc1.checkpoint.com/documents/R77/CP_R77_SecurityManagement_WebAdminGuide/html_frameset.htm) 2. Configure the LDAP CA to be a trusted CA: * Click on *Manage \> Servers and OPSEC Applications \> New \> Certificate Authority \> Trusted.*
### **Machine Authentication in the Security Policy** The Security Policy for Machine Authentication is based on Access Roles rules. ### ***Configuring Machines and Users in an Access Role*** 1. Create an Access Role: 1. In the **Users and Administrators** section of the objects tree, right-click **Access Roles** and select **New Access Role**. 2. Name for the Access Role. For example, Machine_authentication. 2. Add the machines to the Access Role: 1. Click **Machines**. 2. Click **Specific machines/groups**. 3. Choose the LDAP machine group. 4. Click **OK** 3. Add users to the Access Role: 1. Click **Users**. 2. Click **Specific users/groups**. 3. Choose the LDAP user group . 4. Click **OK**. 4. Create the Firewall Policy rule: 1. Go to the **Firewall** tab and click **Policy**. 2. Create a rule 3. Add the Access Role to **Source**column of the rule 5. Install the Access Control Policy. ### ***Example Authentication Rule with an Access Role for Machines and Users*** This is an example of an authentication rule with an Access Role for machines and users: |--------------------------------------|-------------|-----|---------|--------|-------| | Source | Destination | VPN | Service | Action | Track | | Machine_authentication (Access Role) | Any | Any | Any | drop | Log | **The behavior of the rule depends on the configuration of the Access Role.** Here are some examples of Access Role configuration and the resulting behavior of the rule: |---------------------|------------------------|---------------------------|------------------------------------------------------------|-----------------------------------------------------| | Access Role \>Users | Access Role \>Machines | Access Role\> Other pages | Client Connects with | Matches if | | Any | A machine group | Any | Machine authentication (Machine only or Machine and User ) | Machine matches the LDAP Machine group | | A user group | Any | Any | User authentication (User only or Machine and User) | User matches the LDAP User group | | A user group | A machine group | Any | Machine and User authentication | Machine and user both match appropriate LDAP groups | | Any | Any | Any | User authentication (User only or Machine and User) | Any user connects |
* This feature is not supported with SMB appliances. * Machine certificate solution is VSX supported. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content