AnsweredAssumed Answered

Problem authenticating from Checkpoint with software tokens

Question asked by Andrey Trushin on Feb 14, 2019
Latest reply on Dec 29, 2019 by Andrew Kemmy

Like • Show 0 Likes0
Comment • 3

Hello!

When we try to authenticate from checkpoint VPN with SecureID software tokens we receiving the following error in real time monitor:

User “<user ID>" attempted to authenticate using authenticator “SecurID_Native”. The user belongs to security domain “<security domain>”

In trace log we have such lines (txt file in attachment)

Our setup:

RSA Auth Manager 8.4

Checkpoint r77.30 configured as UDP agent in RSA Auth Manager.

User created localy on checkpoint and RSA. In checkpoint we configured SecureID authentication for VPN (mobile access and VPN clients).

Please advise. Thank you!

Attachments

imtracelog.txt.zip1.3 KB

No one else has this question

Outcomes

3 Replies

Erica Chalfin Feb 18, 2019 6:10 PM
Mark Correct
Correct Answer
Andrey Trushin,

I've moved your question to the RSA SecurID Access space where it will be seen by the product's support engineers, other customers and partners. Please bookmark this page and use it when you have product-specific questions.

Alternatively, from the RSA Support page, click on Ask A Question on the blue navigation bar and choose Ask A Product Related Question. From there, scroll to RSA SecurID Access and click Ask A Question. That way your question will appear in the correct space.

Regards,
Erica
Like • Show 0 Likes0
Actions
Edward Davis Feb 19, 2019 12:16 PM
Mark Correct
Correct Answer
1) In the authentication activity log, what is the rest of this message ?
What you provided is only the 'header' but no info on what occurred

User “<user ID>" attempted to authenticate using authenticator “SecurID_Native”.
The user belongs to security domain “<security domain>”

There is more to this message....

2) Do fixed passcodes work ?

-----

3) Typically there is a trick to make Checkpoint work on native Securid (UDP).

If-->The error is auth method failed in the RSA logs, when you know you are using a good pin+token that works on other agents

a) on the RSA server create an agent entry, and the main IP is the management IP of the Checkpoint.
This IP does not need to reach the RSA server nor be able to route to it.

b) on the same agent entry, create a secondary IP, and this is the actual IP of the checkpoint traffic will arrive at the RSA server

The idea here is, RSA will accept any incoming IP if it is somewhere on the agent page. But it will only attempt to decrypt the authentication using the topmost [main] IP. Checkpoints typically encrypt with the management IP only, which is usually not the IP that sends the traffic to the RSA server.

So by doing (a) and (b) above you make an agent entry that will:
-recognize the incoming traffic as belonging to this agent [main IP or any secondary IP]
-but will only try to decrypt the traffic using the main IP [management IP of the checkpoint].
1 person found this helpful
Like • Show 3 Likes3
Actions
- Andrew Kemmy @ Edward Davis on Dec 29, 2019 6:20 PM
  Mark Correct
  Correct Answer
  Very useful thanks, I encountered this error and this solution resolved it.
  Like • Show 1 Like1
  Actions