Ensure that you are using an account with Mobile Application 2FA using ESA enabled. Enter the credentials of your test user.Launch your Check Point Software SecureClient.Select the server you created in section II.Set the authentication scheme to RADIUS.Type the AD user name of your test user (for example, Alice) into the general tab under User Properties.Right click Users and select New User → Default.

Navigate to and expand Users and Administrators.

Enter your shared secret, as shown in Figure 1-1.Select New Radius (for port 1812) from the Service drop-down menu.Enter the IPv4 address of your ESA RADIUS server.Add a name for the server (for example, ESAradserv).Name your new server (for example, ESA).Right-click Servers and select New → RADIUS.Expand the Servers and OPSEC Applications page.Step II - Configure your Check Point Software SSL VPN device You must now configure the Check Point Software SSL VPN device to communicate with the ESA Server. Make sure that the check box next to Mobile Application is selected.ĮSA has now been configured to communicate with the Check Point Software SSL VPN device.It is also recommended that you limit VPN access to a security group in the Users section. To prevent locking any existing, non-2FA enabled AD users out of your VPN we recommend that you allow Non-2FA users during the transitioning phase.In the Authentication section apply the settings shown in Figure 1-1 below The shared secret is the RADIUS shared secret for the external authenticator that you will configure on your appliance. If your appliance communicates via IPv6, use that IP address along with the related scope ID (interface ID). The IP address is the internal IP address of your appliance. Give the RADIUS client a memorable name for easy reference.Ĭonfigure the IP Address and Shared Secret for the Client so that they correspond to the configuration of your VPN appliance. Navigate to Components → RADIUS and locate the hostname of the server running the ESA RADIUS service.Ĭlick the hostname, then click Create New Radius Client. To allow the Check Point Software SSL VPN device to communicate with your ESA Server, you must configure the Check Point Software SSL VPN device as a RADIUS client on your ESA Server: If you wish to utilize other Client type, refer to generic description of Client types and verify with the vendor if the VPN appliance supports it. This integration guide utilizes Client does not validate user name and password Client type for this particular VPN appliance.

Checkpoint mobile vpn client