Connecting to CheckPoint VPN with 2FA
Clash Royale CLAN TAG#URR8PPP up vote
1
down vote
favorite
I'm trying to connect to a CheckPoint VPN which uses two factor authentication (generated token from a mobile device).
I'm aware of the snx tool from CheckPoint, and have used it on other VPNs, but am unable to get it to work with 2FA - or perhaps I just don't know how to use it with 2FA
My question is what are my options, and what's the best option.
- does the snx tool work with 2FA, or is there another CheckPoint client?
- will another client work with a CheckPoint VPN, e.g. StrongSwan, OpenVPN, etc?
I'm working with a plan to run the Windows CheckPoint client in a VM and then route my Ubuntu traffic through the VM's network, but it's clunky at best.
networking vpn virtualbox-networking
asked Mar 31 at 2:55
Kirk Broadhurst
1235
add a comment |Â
up vote
1
down vote
favorite
I'm trying to connect to a CheckPoint VPN which uses two factor authentication (generated token from a mobile device).
I'm aware of the snx tool from CheckPoint, and have used it on other VPNs, but am unable to get it to work with 2FA - or perhaps I just don't know how to use it with 2FA
My question is what are my options, and what's the best option.
- does the snx tool work with 2FA, or is there another CheckPoint client?
- will another client work with a CheckPoint VPN, e.g. StrongSwan, OpenVPN, etc?
I'm working with a plan to run the Windows CheckPoint client in a VM and then route my Ubuntu traffic through the VM's network, but it's clunky at best.
networking vpn virtualbox-networking
asked Mar 31 at 2:55
Kirk Broadhurst
1235
1
StrongSwan is a VPN server for IPSec and not a VPN client. OpenVPN has a client and a server but only speaks OpenVPN. It looks like Checkpoint VPN (CP VPN) under the hood uses a form of IPSec that is tunneled over SSL/TLS. This might be a unique form of technological deployment. In pure theory, if CP VPN is speaking IPSec, then you could theoretically build avpncconfiguration that would work under the hood, but you're restricted to the CLI version of the VPN client for connecting (2FA isn't usable in the NetworkManager plugin forvpnc/IPSec connections). (1/2)
– Thomas Ward♦
Mar 31 at 3:09
1
However, this is a highly speculative answer, as CheckPoint doesn't offer a VPN-only device and only offer it as part of their unified protection gateways, and as CheckPoint gateway solutions are non-free the only people who can really give you clear guidance are going to be the CheckPoint people. They're pushing hard for the SNX tool, though; they don't talk about 2FA though on their forums. You might want to consult with CheckPoint about 2FA enablement/solutions for things. (2/2)
– Thomas Ward♦
Mar 31 at 3:10
It should be possible. I used to have Firefox + java for the web-interface, which just passed stuff to the local snx installation. But I never got my finger around it. Maybe local java debugging could provide some insights.
– RobAu
Aug 15 at 10:36
add a comment |Â
up vote
1
down vote
favorite
up vote
1
down vote
favorite
I'm trying to connect to a CheckPoint VPN which uses two factor authentication (generated token from a mobile device).
I'm aware of the snx tool from CheckPoint, and have used it on other VPNs, but am unable to get it to work with 2FA - or perhaps I just don't know how to use it with 2FA
My question is what are my options, and what's the best option.
- does the snx tool work with 2FA, or is there another CheckPoint client?
- will another client work with a CheckPoint VPN, e.g. StrongSwan, OpenVPN, etc?
I'm working with a plan to run the Windows CheckPoint client in a VM and then route my Ubuntu traffic through the VM's network, but it's clunky at best.
networking vpn virtualbox-networking
asked Mar 31 at 2:55
Kirk Broadhurst
1235
I'm trying to connect to a CheckPoint VPN which uses two factor authentication (generated token from a mobile device).
I'm aware of the snx tool from CheckPoint, and have used it on other VPNs, but am unable to get it to work with 2FA - or perhaps I just don't know how to use it with 2FA
My question is what are my options, and what's the best option.
- does the snx tool work with 2FA, or is there another CheckPoint client?
- will another client work with a CheckPoint VPN, e.g. StrongSwan, OpenVPN, etc?
I'm working with a plan to run the Windows CheckPoint client in a VM and then route my Ubuntu traffic through the VM's network, but it's clunky at best.
networking vpn virtualbox-networking
networking vpn virtualbox-networking
asked Mar 31 at 2:55
Kirk Broadhurst
1235
asked Mar 31 at 2:55
Kirk Broadhurst
1235
asked Mar 31 at 2:55
Kirk Broadhurst
1235
asked Mar 31 at 2:55
Kirk Broadhurst
1235
asked Mar 31 at 2:55
Kirk Broadhurst
1235
1235
1
StrongSwan is a VPN server for IPSec and not a VPN client. OpenVPN has a client and a server but only speaks OpenVPN. It looks like Checkpoint VPN (CP VPN) under the hood uses a form of IPSec that is tunneled over SSL/TLS. This might be a unique form of technological deployment. In pure theory, if CP VPN is speaking IPSec, then you could theoretically build avpncconfiguration that would work under the hood, but you're restricted to the CLI version of the VPN client for connecting (2FA isn't usable in the NetworkManager plugin forvpnc/IPSec connections). (1/2)
– Thomas Ward♦
Mar 31 at 3:09
1
However, this is a highly speculative answer, as CheckPoint doesn't offer a VPN-only device and only offer it as part of their unified protection gateways, and as CheckPoint gateway solutions are non-free the only people who can really give you clear guidance are going to be the CheckPoint people. They're pushing hard for the SNX tool, though; they don't talk about 2FA though on their forums. You might want to consult with CheckPoint about 2FA enablement/solutions for things. (2/2)
– Thomas Ward♦
Mar 31 at 3:10
It should be possible. I used to have Firefox + java for the web-interface, which just passed stuff to the local snx installation. But I never got my finger around it. Maybe local java debugging could provide some insights.
– RobAu
Aug 15 at 10:36
add a comment |Â
1
StrongSwan is a VPN server for IPSec and not a VPN client. OpenVPN has a client and a server but only speaks OpenVPN. It looks like Checkpoint VPN (CP VPN) under the hood uses a form of IPSec that is tunneled over SSL/TLS. This might be a unique form of technological deployment. In pure theory, if CP VPN is speaking IPSec, then you could theoretically build avpncconfiguration that would work under the hood, but you're restricted to the CLI version of the VPN client for connecting (2FA isn't usable in the NetworkManager plugin forvpnc/IPSec connections). (1/2)
– Thomas Ward♦
Mar 31 at 3:09
1
However, this is a highly speculative answer, as CheckPoint doesn't offer a VPN-only device and only offer it as part of their unified protection gateways, and as CheckPoint gateway solutions are non-free the only people who can really give you clear guidance are going to be the CheckPoint people. They're pushing hard for the SNX tool, though; they don't talk about 2FA though on their forums. You might want to consult with CheckPoint about 2FA enablement/solutions for things. (2/2)
– Thomas Ward♦
Mar 31 at 3:10
It should be possible. I used to have Firefox + java for the web-interface, which just passed stuff to the local snx installation. But I never got my finger around it. Maybe local java debugging could provide some insights.
– RobAu
Aug 15 at 10:36
1
1
StrongSwan is a VPN server for IPSec and not a VPN client. OpenVPN has a client and a server but only speaks OpenVPN. It looks like Checkpoint VPN (CP VPN) under the hood uses a form of IPSec that is tunneled over SSL/TLS. This might be a unique form of technological deployment. In pure theory, if CP VPN is speaking IPSec, then you could theoretically build a
vpnc configuration that would work under the hood, but you're restricted to the CLI version of the VPN client for connecting (2FA isn't usable in the NetworkManager plugin for vpnc/IPSec connections). (1/2)– Thomas Ward♦
Mar 31 at 3:09
StrongSwan is a VPN server for IPSec and not a VPN client. OpenVPN has a client and a server but only speaks OpenVPN. It looks like Checkpoint VPN (CP VPN) under the hood uses a form of IPSec that is tunneled over SSL/TLS. This might be a unique form of technological deployment. In pure theory, if CP VPN is speaking IPSec, then you could theoretically build a
vpnc configuration that would work under the hood, but you're restricted to the CLI version of the VPN client for connecting (2FA isn't usable in the NetworkManager plugin for vpnc/IPSec connections). (1/2)– Thomas Ward♦
Mar 31 at 3:09
1
1
However, this is a highly speculative answer, as CheckPoint doesn't offer a VPN-only device and only offer it as part of their unified protection gateways, and as CheckPoint gateway solutions are non-free the only people who can really give you clear guidance are going to be the CheckPoint people. They're pushing hard for the SNX tool, though; they don't talk about 2FA though on their forums. You might want to consult with CheckPoint about 2FA enablement/solutions for things. (2/2)
– Thomas Ward♦
Mar 31 at 3:10
However, this is a highly speculative answer, as CheckPoint doesn't offer a VPN-only device and only offer it as part of their unified protection gateways, and as CheckPoint gateway solutions are non-free the only people who can really give you clear guidance are going to be the CheckPoint people. They're pushing hard for the SNX tool, though; they don't talk about 2FA though on their forums. You might want to consult with CheckPoint about 2FA enablement/solutions for things. (2/2)
– Thomas Ward♦
Mar 31 at 3:10
It should be possible. I used to have Firefox + java for the web-interface, which just passed stuff to the local snx installation. But I never got my finger around it. Maybe local java debugging could provide some insights.
– RobAu
Aug 15 at 10:36
It should be possible. I used to have Firefox + java for the web-interface, which just passed stuff to the local snx installation. But I never got my finger around it. Maybe local java debugging could provide some insights.
– RobAu
Aug 15 at 10:36
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Â
draft saved
draft discarded
Â
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1020745%2fconnecting-to-checkpoint-vpn-with-2fa%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
1
StrongSwan is a VPN server for IPSec and not a VPN client. OpenVPN has a client and a server but only speaks OpenVPN. It looks like Checkpoint VPN (CP VPN) under the hood uses a form of IPSec that is tunneled over SSL/TLS. This might be a unique form of technological deployment. In pure theory, if CP VPN is speaking IPSec, then you could theoretically build a
vpncconfiguration that would work under the hood, but you're restricted to the CLI version of the VPN client for connecting (2FA isn't usable in the NetworkManager plugin forvpnc/IPSec connections). (1/2)– Thomas Ward♦
Mar 31 at 3:09
1
However, this is a highly speculative answer, as CheckPoint doesn't offer a VPN-only device and only offer it as part of their unified protection gateways, and as CheckPoint gateway solutions are non-free the only people who can really give you clear guidance are going to be the CheckPoint people. They're pushing hard for the SNX tool, though; they don't talk about 2FA though on their forums. You might want to consult with CheckPoint about 2FA enablement/solutions for things. (2/2)
– Thomas Ward♦
Mar 31 at 3:10
It should be possible. I used to have Firefox + java for the web-interface, which just passed stuff to the local snx installation. But I never got my finger around it. Maybe local java debugging could provide some insights.
– RobAu
Aug 15 at 10:36