VPN / Authentication

When will Azure Active Directory integration be added to the Quantum Spark appliances? Will it support multifactor authentication?

Support for Azure AD is planned during 2025 for all supported Quantum Spark versions.

Is SAML supported?

SAML is supported starting in the R81.10.15 release, for both Centrally Managed and Locally Managed Quantum Spark appliances.

How does Check Point work with dynamic IP as a third-party VPN vendor?

When using a Check Point Gateway in the DAIP configuration (Dynamically Assigned IP Address) and the 3rd-party peer is static (or vice versa), FQDN or the "key_id" authentication factor should be used as the "IP_ADDRESS" because the authentication factor is dynamic.

Is it possible for the Centrally Managed Quantum Spark appliances to act as the central gateway in a Star VPN topology?

Centrally Managed Quantum Spark appliances cannot act as the Center Gateway in the Star VPN topology.

Can we configure VPN with a third-party peer without using a certificate in Quantum Spark Management? In this way, we can also achieve integration with Quantum SASE?

Currently, this is not supported.

Do Quantum Spark appliances have auto IPsec failover feature, such as VPN redundancy?

When a Quantum Spark appliance is configured with more than one ISP, and the active ISP link becomes unstable / drops, the backup ISP links takes over, and a new VPN tunnel is established on it.

Can we configure a secondary (backup) IP address to the same AD domain?

Currently, this is supported on Centrally Managed appliances.

Is it possible to configure the LDAP fetch frequency?

Configuring the LDAP fetch frequency is not supported.

Is there any plan to allow specific AD users to use the "Source" column in the policy rules?

Currently, it is only possible to use AD groups.

For additional information, see sk105977.

Do all Quantum Spark appliances fully support Identity Awareness?

Yes, Identity Awareness is supported.

Identity Collector is supported starting from the R81.10.05 release.

Will it be possible to bypass Browser-Based Authentication via WebUI?

You can configure this bypass in WebUI on Locally Managed appliances.

Browser-Based Authentication via WebUI is not supported for Centrally Managed appliances.

What are the VPN S2S common configurations' issues? Is there any plan to improve user ability ti troubleshooting these issues?

Below are some of the common configuration issues when using Site to Site VPN:

Wrong configuration of encryption.
Authentication.
IKE version while other peer is configured differently.
Wrongly configured encryption domains.
Local NAT is enabled when the Quantum Spark Gateway is behind a Hide NAT device.

In the R81.10.15 release, we improved troubleshooting capabilities by adding additional VPN tunnel data to WebUI, VPN notifications, and the new extended monitoring feature to provide a thorough view for Remote Access VPN.