User - Authentication

What can I do here?

Use this window to set an authentication method for the user.

User Authentication Options

Select the scheme to be used to authenticate users defined with this template. These schemes are used in authentication rules and in Remote Access (when the user is not identified using a certificate or an IKE preshared secret).

Select one of these authentication methods:

• Undefined - means that either no authentication is performed and access is always denied, or IKE authentication is used, as defined in the Encryption tab.

  If a user with an undefined authentication scheme is matched to a Security Rule with some form of authentication, access is always denied.

• SecurID - means that users are challenged to enter the number displayed on the Security Dynamics SecurID card. There are no scheme-specific parameters for this authentication scheme. The Security Gateway acts as an ACE/Agent 5.0.

  SecurID requires users to both possess a token authenticator and to supply a PIN or password. Token authenticators generate one-time passwords that are synchronized to an RSA ACE/server and may come in the form of hardware or software. Hardware tokens are key-ring or credit card-sized devices, while software tokens reside on the PC or device from which the user wants to authenticate. All tokens generate a random, one-time use access code that changes approximately every minute. When a user attempts to authenticate to a protected resource, the one-time use code must be validated by the ACE/server.

  Using SecurID, the Security Gateway forwards authentication requests by remote users to the ACE/server. ACE manages the database of RSA users and their assigned hard or soft tokens. The gateway acts as an ACE/Agent 5.0 and directs all access requests to the RSA ACE/server for authentication. For additional information on agent configuration, refer to ACE/server documentation.

  There are no specific parameters required for the SecurID authentication scheme.

• Check Point Password - means that users are challenged to enter the internal Check Point password on the gateway.

  The Security Gateway stores a static password in the local user database of each user configured in Security Management Server.

• OS Password - means that users are challenged to enter their Operating System password for the Security Management Server. There are no scheme-specific parameters for this authentication scheme.

  The Security Gateway can authenticate using the user name and password that is stored on the operating system of the machine on which the Security Gateway is installed. You can also use passwords that are stored in a Windows domain.

• RADIUS - means that users are challenged for the response, as defined by the RADIUS server. Select the RADIUS server object here.

  Remote Authentication Dial-In User Service (RADIUS) is an external authentication scheme that provides security and scalability by separating the authentication function from the access server.

  Using RADIUS, the Security Gateway forwards authentication requests by remote users to the RADIUS server. The RADIUS server, which stores user account information, authenticates the users.

  The RADIUS protocol uses UDP to communicate with the gateway. RADIUS servers and RADIUS server group objects are defined in SmartConsole.

• TACACS - means that users are challenged for the response, as defined by the TACACS or TACACS+ server. Select the server object here.

  Terminal Access Controller Access Control System (TACACS) provides access control for routers, network access servers and other networked devices through one or more centralized servers.

  TACACS is an external authentication scheme that provides verification services. Using TACACS, the Security Gateway forwards authentication requests by remote users to the TACACS server. The TACACS server, which stores user account information, authenticates users. The system supports physical card key devices or token cards and Kerberos secret key authentication. TACACS encrypts the user name, password, authentication services and accounting information of all authentication requests to ensure secure communication.