Hello,
We would like to start to authenticate our internal users for use of external resources (i.e. internet usage). We are currently running NG (R55) and using a Win2k box for IAS [RADIUS] authentication of our VPN users.
Besides building all of our users into SmartConsole to authenticate against the FW-1 user base is there a way I can make my RADIUS box allow the internal users out (logging the connection) but not let them VPN in also?
As I see it, when I add the policy to allow access in IAS it will not matter from what interface the user hits the CP box from. FW-1/VPN-1 will look to IAS for authentication, IAS will accept the connection as a valid user, and CP will allow the data through; wither the user is setting at their machine inside the building or sitting at home with a rouge VPN connection.
The only solution I can see right now is to implement two separate RADIUS servers. One to authenticate internal users wishing to access external resources, and one to authenticate valid external users wishing to initiate a VPN connection with the network.
Any feedback is, of course, appreciated.
Hi, if I understand you right, you want to make a difference between users authenticating in a VPN (incoming) and users to access from the internal nets to the Internet (outgoing). And, you don't want to put all users into the user database of NG. For making a difference between internal users to authenticate and users of the VPN you declare two groups of Network objects, e.g.
InternalNetworks: New - Group - group of internal nets, InternalNetworks VPNgroup: New - Group w. exclusion - VPNgroup "any exept InternalNetworks"
Then, you will have do configure two rules with the referring source:
[EMAIL PROTECTED] any anyVPN Services Authentication ... and [EMAIL PROTECTED] InternalNetworks VPNcommunity Services Authentication...
For not all RADIUS users needed to be imported in NG you can use External User Profiles in the UserManager. The overall joker is a user profile called "generic*" (Match all users). Here, you give your RADIUS server in the Tab Authentication and define the rest. Then, you can put this user profile into a user group, e.g. InternalUsers. If a user authenticates with a name the Security Server doesn't know, it will ask the RADIUS server for it.
Hope it helps, best regards, Matthias http://www.fw-1.de -- AERAsec Network Services and Security GmbH Wagenberger Strasse 1 D-85662 Hohenbrunn, Germany http://www.aerasec.de
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
